We've assessed the security posture of dozens of Saudi company websites as part of penetration testing engagements. The same vulnerabilities appear repeatedly.
1. Outdated CMS and plugin versions
WordPress sites running plugins from 2020 are the single most common entry point we see. Auto-updates are disabled, nobody's monitoring CVEs, and the attack surface is enormous.
2. Default credentials left unchanged
Admin panels, database management tools, and server control panels with default passwords. We find these on roughly 1 in 3 Saudi SME websites.
3. Missing HTTP security headers
Content-Security-Policy, X-Frame-Options, Strict-Transport-Security. These cost nothing to configure and block entire classes of attacks. We rarely see them properly configured.
4. User-supplied data in SQL queries without sanitization
SQL injection should be a solved problem in 2026. It isn't. We find exploitable SQL injection vulnerabilities regularly — often in custom admin panels built by freelancers.
5. No rate limiting on authentication endpoints
Login pages, password reset endpoints, and OTP verification flows without rate limiting are trivially brute-forced.
6. File upload without type validation
Contact forms and profile image uploads that accept any file type. A PHP webshell uploaded through a "profile picture" endpoint is a complete server compromise.
7. Missing backup and recovery plan
Not a direct attack vector, but the consequence of a successful attack without tested backups is catastrophic. We've seen companies lose years of data to ransomware that backups would have made a non-event.