MITRE's 2025 CWE Top 25 ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second, and cross-site request forgery (CWE-352) third. A CWE is a type of mistake in software, not a single bug. The list is built from weaknesses behind published CVEs and scored by how often and how severely they appear.
What is the list and where does it come from?
The Common Weakness Enumeration is a catalogue of software and hardware weakness types maintained by MITRE. The Top 25 page shows a score for each entry. The page I fetched was last updated on 15 December 2025 and does not state the data window on that page, so read MITRE's methodology page before quoting how the scoring works.
A CVE is one flaw in one product. A CWE is the family it belongs to. Fixing a CVE closes one hole. Learning the CWE tells you how to stop the next one.
The 25, in plain language
- CWE-79, cross-site scripting. A site shows untrusted input as page code, so an attacker's script runs in a visitor's browser.
- CWE-89, SQL injection. Input is mixed into a database query and changes what the query does.
- CWE-352, cross-site request forgery. A logged-in user's browser is tricked into sending an action they did not intend.
- CWE-862, missing authorization. The app never checks whether this user may do this thing.
- CWE-787, out-of-bounds write. A program writes outside the memory it owns.
- CWE-22, path traversal. Input like dot-dot paths reaches files outside the intended folder.
- CWE-416, use after free. Memory is used after it was released.
- CWE-125, out-of-bounds read. A program reads memory it should not.
- CWE-78, OS command injection. Input ends up inside a system command.
- CWE-94, code injection. Input is treated as code to run.
- CWE-120, classic buffer overflow. Data is copied into a buffer without checking its size.
- CWE-434, dangerous file upload. The app accepts a file type that can be run.
- CWE-476, null pointer dereference. The program uses something that is not there and crashes.
- CWE-121, stack-based buffer overflow. A buffer overflow on the stack.
- CWE-502, unsafe deserialization. Untrusted data is turned back into objects, sometimes running code.
- CWE-122, heap-based buffer overflow. A buffer overflow in heap memory.
- CWE-863, incorrect authorization. A check exists but gets the answer wrong.
- CWE-20, improper input validation. Input is accepted without checking it is safe.
- CWE-284, improper access control. A broad label for access rules that do not hold.
- CWE-200, sensitive information exposure. Data goes to someone who should not see it.
- CWE-306, missing authentication. An important function needs no login.
- CWE-918, server-side request forgery. The server is tricked into making requests for the attacker.
- CWE-77, command injection. Input ends up inside a command of any kind.
- CWE-639, authorization bypass via user-controlled key. Changing an ID in a request shows someone else's record.
- CWE-770, no limits on resource use. Missing throttling lets a request use up memory, time or storage.
What patterns stand out?
Input handling dominates. Entries 1, 2, 9, 10, 18 and 23 are all the same root habit: trusting input.
Access control spreads across several rows. Entries 4, 17, 19, 21 and 24 are different faces of "the app did not ask who you are or what you may do."
Memory safety fills the middle. Entries 5, 7, 8, 11, 13, 14 and 16 mostly affect code written in languages that leave memory management to the programmer.
Scores on the page fall sharply after the first two: 60.38 for cross-site scripting, 28.72 for SQL injection, then 13.64 for the third.
What to do
- Pick the CWEs your stack is exposed to. A web team starts with 79, 89, 352, 862 and 22.
- Use framework defaults for output encoding, parameterised queries and request forgery tokens, and avoid bypassing them.
- Write authorization as one shared function and test it for each endpoint with a second user account.
- Tag your scanner findings by CWE so you can see which family repeats in your code.
- Prefer memory-safe languages for new components where practical.
- Pick one CWE a quarter and add a lint rule, a test or a code review checklist line.
Quick check
What is the difference between a CVE and a CWE?
A CVE identifies one specific vulnerability in a product. A CWE names the general type of weakness, such as SQL injection, that many CVEs share.
Which weakness is ranked first in the 2025 Top 25?
Cross-site scripting, CWE-79, with a score of 60.38 on the MITRE page.
Sources
Last reviewed: 18 October 2026.
