There are different types security risks for web application:

Some of them are:

1. SQL Injection
2. Broken authentication and Session management.
3. Cross site scripting
4. Insecure Direct Object References
5. Security Misconfiguration
6. Sensitive Data Exposure
7. Cross site request forgery.
8. Unvalidated redirects and forwards.

1. SQL Injection- SQL injection is a application vulnerability where attacker try to write and inject the malicious database script to theft the user information. Attacker can insert the script in the text fields given in the form, and this field value is appended to the database query without sanitization or validation. Attacker can reads the confidential data, alter the data or delete some important data.

2. Broken authentication and Session management - This is a type of vulnerability in which authentication and session management are not implemented correctly such that attackers can get password, authentication key,session token etc and exploit the other user identities.
This is due to the following reasons :

a. When we store passwords in plain text.
b. Passwords are easy to guess.
c. Transmitting password in the form of plain text.
d. Session Id's passed in url.
e. Allowing many login attempts.

3. Cross site scripting-  Cross-Site Scripting(XSS) is a type of vulnerability in which attacker can insert and run the client side script in the web application.It occurs when user does not validate or encode the user inputs and show it in the browser directly. The most common scripting language is JavaScript which is used to XSS attack. In this attacker find browser cookies, sessions and use this information for wrong purpose or may damage some important information of the site.

4. Insecure Direct Object References -It is a type of vulnerability in which developer directly exposes internal objects like file , directory or any database access without and validation that will allow attacker to manipulate the references. In these attacker bypass the authorization and access resources. These resources can either be database entries, files etc.

5. Security Misconfiguration - It is a type of vulnerability which occurs when security settings are defined, maintained and implemented as default. Good security requires secure configuration. All the secure settings should be properly defined, maintained and implemented. This include keeping all software up to date.

6.Sensitive Data Exposure - It is a type of vulnerability that occur when application does not protect sensitive information from disclosed to attackers. It include information as password, credit card data, session tokens or any other authentication details.

7.Cross site request forgery - It is a type of vulnerability that occurs when an attacker will send a request to web application that a user is already authenticated from a different website. In such way a functionality can be easily accessible to an attacker in target application using user already authenticated browser. Targets include social media , online banking etc.

8.Unvalidated redirects and forwards -It occurs when a web application accept any input without any proper validation and redirect and forward urls. To launch a phishing scam and to steal user authentications an attacker can do this by modifying untrusted url.