> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Impacts
> Business-focused categories that describe the real-world consequence of vulnerabilities.
export const DegradePerformanceIcon = () => ;
export const EvadeDetectionIcon = () => ;
export const AccessApplicationStateIcon = () => ;
export const FacilitateClientSideAttacksIcon = () => ;
export const BypassCryptographicControlsIcon = () => ;
export const InsufficientDataProtectionIcon = () => ;
export const InterceptTrafficIcon = () => ;
export const AccessFilesIcon = () => ;
export const AccessDataIcon = () => ;
export const ObtainSecretsIcon = () => ;
export const GainAccessIcon = () => ;
export const TakeoverAccountsIcon = () => ;
export const ExecuteCommandsIcon = () => ;
## Overview
Impacts describe attacker outcomes. They answer a simple question: if a vulnerability is exploited, what happens? This helps teams prioritize remediation and explain risk in plain language.
## Why impacts matter
* **Filter by consequence**: find all vulnerabilities that could lead to account takeover, regardless of the technical category
* **Communicate risk**: explain security issues to non-technical stakeholders in terms they understand
* **Prioritize effectively**: focus on high-impact vulnerabilities first
## Impact categories
Cysmiq uses 13 standardized impact categories.
}>
Execute arbitrary code or commands, e.g. command injection, unsafe deserialization, template injection, or XXE.
}>
Authenticate as another user or hijack sessions, e.g. auth bypass, session fixation, or weak session controls.
}>
Bypass authorization or escalate privileges, e.g. missing access checks, IDOR, or over-broad allowlists.
}>
Extract credentials or keys for reuse, e.g. hardcoded secrets, token exposure, or leaked key material.
}>
Read or manipulate structured data, e.g. SQL injection, LDAP injection, or unsafe query construction.
}>
Read or modify files or paths, e.g. path traversal, file inclusion, or insecure archive handling.
}>
Observe or alter data in transit, e.g. TLS validation failures or weak transport protections.
}>
Sensitive data at rest is not adequately protected, e.g. weak encryption, weak hashing, or missing integrity checks.
}>
Predict or undermine cryptographic controls, e.g. weak randomness, predictable tokens, or signature verification flaws.
}>
Target end users, e.g. XSS, open redirect, CSRF, clickjacking, or insecure cookie flags.
}>
Learn internal state or configuration, e.g. debug info leakage, verbose errors, or config exposure.
}>
Avoid logging or monitoring, e.g. missing audit events or log tampering.
}>
Exhaust resources or reduce availability, e.g. DoS or resource exhaustion.
## How impacts are assigned
Impacts are assigned based on CWE mappings and attacker outcomes. When a vulnerability is detected, it inherits the impacts associated with that CWE category.
A vulnerability can have multiple impacts, and filters match any assigned impact.
For example:
* A SQL injection vulnerability gets the **Access Data** impact
* A command injection vulnerability gets the **Execute Commands** impact
* A weak password hash gets the **Insufficient Data Protection** impact
## Related docs
* [Impact Reference](/reference/impacts): detailed CWE mappings for each impact
* [Vulnerability list view](/vulnerability-management/vulnerability-list-view): filter vulnerabilities by impact
* [Vulnerability detail view](/vulnerability-management/vulnerability-detail-view)