Vulnerabilities and attacks on the web?

Question

CodeIgniter

Good day.
I'm using CodeIgniter with XSS filters, filtered DB queries, don't trust inputs; know about/believe protected from: XSS, php/sql-inject, HTTP Response Splitting, CSRF. The site works on HTTPS.
But I need a little more paranoid protection. And so I ask:
1. What other popular types of vulnerabilities are there in the context of websites?
2. What are some security jokes about php itself?
3. Where to read about all this?

Answer 1

Directory Permissions... Exposing Paths...

Answer 2

Check out the site www.owasp.org
It is designed to answer just such questions. True, it is in English.

Answer 3

It would be easier if you showed the site, and people would look at it%)

Answer 4

display_errors was not mentioned

Answer 5

clickjacking

Answer 6

Maybe an executable downloaded as a picture? True, this is an attack, rather, on the client browser than on the server,

Answer 7

is there ajax? Also check that you don’t do too much without authorization ...

Answer 8

Clickjacking (X-Frame-Options header), DOM XSS, look at the Content Security Policy, useful stuff.

Answer 9

Credential/Session Prediction
XML External Entity Attacks
LFI over PHPinfo
Weak passwords