> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/cybersecurity-basics/vulnerabilities.md).
# Vulnerabilities
A **vulnerability** is a weakness or flaw in the design or implementation of a system or application that could be exploited by an attacker to compromise its security.
Vulnerabilities can arise from a variety of sources, such as poor coding practices, outdated software, misconfigurations, lack of encryption, or weak access controls. When left unaddressed, these weaknesses can allow attackers to gain unauthorized access, execute malicious code, escalate privileges, steal sensitive data, or disrupt services.
## Vulnerability vs Threat vs Risk
The relationship between vulnerabilities, threats, and risks is essential for assessing and mitigating security issues effectively. This relation exposes that by reducing **vulnerabilities** and implementing security controls, organizations can lower their **risk** exposure to a **threat** as follows:
These concepts can be understood as follows:
* **Vulnerability:** A weakness in a system, process, or person that can be exploited by a threat
* **Threat:** Any circumstance, event, or actor that can cause damage to an organization's information assets
* **Risk:** The possibility of a threat exploiting a vulnerability and generating a negative impact. It is calculated as *Risk = Probability x Impact*
* **Impact:** The negative effect a security incident can have, which can affect confidentiality, integrity, availability, or cause financial or reputational damage
