A05: Injection
Injection occurs when an attacker is able to insert malicious input into an application, causing it to execute unintended commands or queries. This vulnerability arises when user input is improperly handled, allowing attackers to manipulate databases, operating systems, or other backend services. Injection attacks can lead to data breaches, unauthorized access, remote code execution (RCE), and full system compromise. In the OWASP Top 10:2025 this category also covers Cross-Site Scripting (XSS), which remains one of the most reported weaknesses in the entire dataset.
Common Vulnerabilities:
- SQL Injection (SQLi) – Manipulating database queries
- Command Injection – Executing system commands
- Cross-Site Scripting (XSS) – Injecting malicious scripts in web pages
- Code Injection – Evaluating attacker-controlled code server-side
- LDAP Injection – Manipulating directory service queries
- NoSQL and ORM Injection – Exploiting document stores and query builders
- Expression Language and Template Injection – Abusing server-side template engines
- Email Header and HTTP Response Header Injection
To mitigate these risks, applications should use parameterized queries (prepared statements), validate and sanitize user input, escape output according to its rendering context, enforce content security policies (CSP), and implement least privilege access for backend services. Regular security testing, including automated scans and manual penetration testing, is essential to detect and prevent injection vulnerabilities.
Note: XML External Entity (XXE) processing was historically discussed alongside injection. OWASP maps it to A02: Security Misconfiguration, where you will find it in this wiki.
In this section
- Stored Cross-Site Scripting (XSS), in a database or file system), and later includes that data within the rendered response without proper output encoding or sanitization.
- Reflected Cross-Site Scripting (XSS)Reflected Cross-Site Scripting (XSS) occurs when an attacker injects malicious code into a vulnerable field or…
- DOM-Based Cross-Site Scripting (XSS)DOM-based Cross-Site Scripting (XSS) is a variant of XSS where the entire exploit occurs in the Document…
- SQL Injection (SQLi)SQL Injection is a critical web application vulnerability where attackers manipulate user input to alter SQL queries sent to a database.
- Code InjectionCode Injection is a critical security flaw where an attacker can supply malicious input that the application interprets or executes as code.
Last updated
