Open research questions in Web Application Security Vulnerabilities
46 gap statements mined from Web Application Security Vulnerabilities papers in our 4.5M-paper local library, which holds 270 papers on the topic — drawn mostly from each paper's own stated research gap, future-work, challenge and limitation notes, and its abstract. The ones listed below are a selection still marked open; each names the study that raised it, with a DOI link where the paper has one.
Choosing where to publish on Web Application Security Vulnerabilities? See the ranked Computer Science journals.
What the literature leaves open
The lack of effective protection methods against SQL injection attacks. The limitations of traditional defensive techniques. The need for a more advanced and dynamic protection system.
ARTIFICIAL INTELLIGENCE–BASED PROTECTION METHODS AGAINST SQL INJECTION IN RELATIONAL DATABASES · 2026 · DOIThe scanner addresses key limitations of existing solutions—namely high cost, complexity, and fragmentation—by delivering a free, cohesive, and accessible alternative. It is particularly valuable for educational environments, independent researchers, and small organizations seeking to improve their security posture without significant investment.
Traditional security mechanisms are not able to detect new or unknown threats. The lack of a hybrid approach that combines rule-based detection with AI-based anomaly detection. The need for a scalable and industrially applicable framework for safeguarding cloud-based ecosystems.
The lack of secure and scalable authentication mechanisms in digital traffic offense management systems. The vulnerability of single-factor authentication strategies to credential theft and phishing. The need for a novel Multi-Factor Authentication framework that integrates knowledge-based, possession-based, and inherence-based authentication levels.
A Secure Multi-Factor Authentication Framework for Digital Traffic Offense Management Systems · 2026 · DOIThe lack of proper input validation and secure query handling in many web applications.
The challenge is to detect advanced or unknown threats. The challenge is to reduce false alerts while ensuring real threats are not missed. The challenge is to provide a reliable, scalable, and easy-to-maintain solution for modern network environments.
The gap is the limitation of traditional security tools in detecting advanced or unknown threats. The gap is the need for a more effective solution to improve network security.
The system was tested using a limited number of test cases. The system was developed for a specific use case and may not be generalizable to other domains.
FitZone GYM Membership System: A Secure-by-Design Web Application Following the Secure Software Development Lifecycle · 2026 · DOIIt highlights the need for a holistic perspective that integrates technical analyses with organizational and practical considerations.
Existing solutions have limitations in detecting DOM-XSS vulnerabilities. There is a need for a more effective approach to detect DOM-XSS vulnerabilities. Current solutions can't handle obfuscated attack payloads effectively.
The security of web-use agents has not been thoroughly explored. The attack surface of web-use agents bypasses traditional browser security mechanisms.
Existing methods for detecting vulnerability fixes do not effectively highlight nuanced differences in code changes. Previous approaches fine-tune code embedding models and classification models separately, limiting overall effectiveness. There is a need for a framework that can capture fine-grain changes in code and improve the detection of vulnerability fixes.
VFDelta: A Framework for Detecting Silent Vulnerability Fixes by Enhancing Code Change Learning · 2026 · DOIFuture research can focus on improving the detection accuracy and timeliness of the SIEM system. Future research can explore the application of the SIEM system in different network environments.
Implementation of security information and event management (SIEM) with telegram notifications to detect data exfiltration · 2026 · DOIThe study identifies a gap in the development of security monitoring systems that are adaptive and responsive to data exfiltration threats. The study highlights the importance of detecting data exfiltration activities in real time.
Implementation of security information and event management (SIEM) with telegram notifications to detect data exfiltration · 2026 · DOIReliance solely on manual testing is insufficient; therefore, a comprehensive list of protection automation measures within the CI/CD pipeline is provided.
The possible directions of further research into the methods of automated search for SQL vulnerabilities in web applications are substantiated, taking into ac-count the results obtained, in particular the values of the Youden Index.
RESEARCH OF METHODS OF AUTOMATED SEARCH OF “SQL INJECTION” TYPE VULNERABILITIES IN WEB APPLICATIONS · 2022 · DOIThe study was conducted in a controlled environment, which may not reflect real-world scenarios. The experiments were limited to intentionally vulnerable web applications and a local server environment.
Advanced session management features such as expiration, HttpOnly/Secure cookie attributes can be implemented. The system can be integrated with existing gym management software to provide an additional layer of security.
FitZone GYM Membership System: A Secure-by-Design Web Application Following the Secure Software Development Lifecycle · 2026 · DOIThe increasing complexity and extensive use of websites have made them a main goal for cyber attacks. General weaknesses such as SQL injection, scripting across the site (XSS), and crossing counterfeiting (CSRF) highlight applications for risks.
In: LREC, European Language Resources Association, pp 2909–2918 Myers SL (1980) Why are crimes underreported?
Further evaluation of the proposed system in different scenarios and environments. Investigation of other machine learning algorithms for anomaly detection. Development of more advanced threat detection techniques.
Basic-block abstraction for JavaScript taint. Adapting AirTaint's granularity reduction mechanism for JavaScript.
Evaluating the attack on a large scale. Developing security mechanisms to prevent task-aligned injection attacks. Exploring the potential risks of using LLMs in web-use agents.
Investigating the application of VFDelta's code change representation to other tasks, such as just-in-time defect prediction and commit message…
VFDelta: A Framework for Detecting Silent Vulnerability Fixes by Enhancing Code Change Learning · 2026 · DOIThe following extensions would meaningfully increase the practical scope of SecureX: Page…
Most-cited papers in Web Application Security Vulnerabilities
- VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability Detector · IEEE Transactions on Dependable and Secure Computing · 2021 · 228 citations
- Computer Intrusion: Detecting Masquerades · Statistical Science · 2001 · 181 citations
- Measuring, analyzing and predicting security vulnerabilities in software systems · Computers & Security · 2006 · 177 citations
- Security models for web-based applications · Communications of the ACM · 2001 · 124 citations
- Improving user security behaviour · Computers & Security · 2003 · 116 citations
- Improving system security via proactive password checking · Computers & Security · 1995 · 103 citations
- An ensemble learning approach for XSS attack detection with domain knowledge and threat intelligence · Computers & Security · 2019 · 95 citations
- LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarks · 2024 · 89 citations
- Finetuning Large Language Models for Vulnerability Detection · IEEE Access · 2025 · 88 citations
- Native Client · Communications of the ACM · 2009 · 84 citations
Most recent work
- LLMs as Hackers: Autonomous Linux Privilege Escalation Attacks · Empirical Software Engineering · 2026
- Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction · 2026
- Privacy-preserving federated hybrid deep learning framework for robust cross-site scripting detection in distributed web applications · Journal of Intelligent & Fuzzy Systems: Applications in Engineering and Technology · 2026
- Modern web application security in practice: National-scale measurement and managerial insights from Türkiye · Computers & Security · 2026
- Did I Vet You Before? Assessing the Chrome Web Store Vetting Process Through Browser Extension Similarity · IEEE Transactions on Services Computing · 2026
- Scalable hierarchical protocol format inference via feature-heuristic message delimiter · Empirical Software Engineering · 2026
- From Function to Repository: Towards Repository-Level Evaluation of Software Vulnerability Detection · IEEE Transactions on Software Engineering · 2026
- LIVA: A Multi-Agent LLM-Assisted System for IoT Vulnerability Analysis · IEEE Transactions on Dependable and Secure Computing · 2026
- Clara: A Cross-Modal Learning Framework for Enhanced Vulnerability Detection · IEEE Transactions on Dependable and Secure Computing · 2026
- CIR-SQL: A Dual-Model Intent Recognition Framework for Chinese Text-to-SQL · AI · 2026
Find a gap in your own Web Application Security Vulnerabilities sub-topic
This page shows what the Web Application Security Vulnerabilities literature already flags as unresolved. To narrow it to your specific question, search the Research Gap Finder: the search is free with a free account and lists the papers closest to your topic first. Unlocking that topic (50 credits, charged once) fills the comparison table from our 4.5M-paper local library and writes the gaps from its rows.
Open the Research Gap Finder →