## 4 Materials and Methods
### Inputs  
To generate inputs, the first step is identifying the programming languages that are most susceptible to security issues. Based on the findings presented in [37], the considered factors included the number of entries in the CVE [7] database, associated Common Weakness Enumerations (CWE) [38], and Common Vulnerability Scoring System (CVSS) [39] scores. The CVE database assigns unique identifiers to publicly disclosed security flaws; CWEs categorize issues according to their weaknesses; and CVSS scores evaluate the severity of flaws, classifying them as low (0.1-3.9), medium (4.0-6.9), or high (7.0-10.0). An analysis of the MITRE National Vulnerability Database (NVD) [40] associated CVEs with their respective CWEs, revealing that PHP, Java, C, and C++ had the highest number of reported security concerns, as conveyed in Table 1.  
Table 1 delineates the primary CWEs impacting PHP, Java, C, and C++, emphasizing critical security flaws across diverse technologies. CWE-20 (Improper Input Validation) significantly affects PHP web applications, including Content Management Systems (CMS) such as WordPress, and is also prevalent in Java-based enterprise platforms, leading to improper parameter handling in APIs. CWE-79 (Cross-Site Scripting) represents a major risk in both PHP and Java. In PHP, it compromises dynamic websites, while in Java, it frequently impacts frameworks like Spring and Struts. CWE-89 (SQL Injection) affects PHP  
Figure 1: Blocks of the proposed methodology. interaction with relational databases like MySQL and PostgreSQL, and Java applications, particularly in ORM tools like Hibernate. Memory management issues dominate in C and C++. CWE-119 (Improper Restriction of Memory Buffer) and CWE-125 (Out-of-Bounds Read) are prevalent in systems-level software and real-time operating systems, leading to vulnerabilities in network stacks and embedded systems. Similarly, CWE-416 (Use-After-Free) and CWE-476 (NULL Pointer Dereference) appear in C and C++ libraries for scientific computing and game engines. These vulnerabilities contribute to 42% of high-severity issues, as indicated by CVSS scores. CWE-502 (Deserialization of Untrusted Data) primarily affects Java and PHP applications, with risks evident in serialization libraries and frameworks like Apache Commons and Laravel. CWE-434 (Unrestricted File Upload) is another notable PHP vulnerability, frequently exploited in web hosting platforms, while CWE-352 (Cross-Site Request Forgery) compromises session security in both PHP and Java-based e-commerce platforms. Concurrency and resource management issues are prominent in C and C++. CWE-362 (Concurrent Execution Vulnerability) impacts real-time systems and database engines, causing deadlocks and race conditions. CWE-399 (Resource Management Errors) is pervasive in multimedia libraries, contributing to medium-severity vulnerabilities. CWE-400 (Uncontrolled Resource Consumption) impacts Java and C++, particularly in cloud-based solutions, leading to denial-of-service risks. CWE-306 (Missing Authentication for Critical Functionality), CWE-601 (Open Redirect), and CWE-611 (Improper Restriction of XML External Entity Reference) are recurring in web and API-based systems across PHP and Java, while CWE-732 (Incorrect Permission Assignment) is observed in Java frameworks used for authentication and authorization. These issues underline the critical need for sophisticated solutions to mitigate vulnerabilities across languages and technologies. According to the study titled _Comprehensive Vulnerability Analysis Across Programming Languages_[11], which employed NBR to examine the proneness of languages to vulnerabilities, certain languages exhibit elevated vulnerability scores. In particular, NBR was used to analyze the occurrence of vulnerabilities in programming languages and assess factors such as memory management, input validation, and access control.