OWASP Top Ten 2025 Category A05:2025 - Injection

Opis

Weaknesses in this category are related to the A05 category "Injection" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-103 Struts: Incomplete validate() Method Definition
• CWE-104 Struts: Form Bean Does Not Extend Validation Class
• CWE-112 Missing XML Validation
• CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
• CWE-114 Process Control
• CWE-115 Misinterpretation of Input
• CWE-116 Improper Encoding or Escaping of Output
• CWE-129 Improper Validation of Array Index
• CWE-159 Improper Handling of Invalid Use of Special Elements
• CWE-20 Improper Input Validation
• CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
• CWE-493 Critical Public Variable Without Final Modifier
• CWE-500 Public Static Field Not Marked Final
• CWE-564 SQL Injection: Hibernate
• CWE-610 Externally Controlled Reference to a Resource in Another Sphere
• CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
• CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• CWE-76 Improper Neutralization of Equivalent Special Elements
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CWE-83 Improper Neutralization of Script in Attributes in a Web Page
• CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
• CWE-91 XML Injection (aka Blind XPath Injection)
• CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
• CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
• CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
• CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła