OWASP A05:2025 Injection covers flaws where untrusted input reaches an interpreter that runs it as commands. It maps to 37 CWEs and includes cross-site scripting and SQL injection. It is the category most tested, with every application in the data checked for some form of injection.
What the category says
The OWASP Top 10 2025 page for A05 describes injection as an application flaw allowing untrusted input to be sent to an interpreter and run as commands. An application is vulnerable when user data is not validated, filtered or sanitized, when dynamic queries or non-parameterized calls are used without context-aware escaping, when unsanitized data is used in object relational mapping search parameters to extract extra records, or when hostile data is concatenated directly into a query or command.
The numbers on the page
These come straight from OWASP's data table for the category.
| Measure | Value |
|---|---|
| CWEs mapped | 37 |
| Maximum incidence rate | 13.77% |
| Average incidence rate | 3.08% |
| Maximum coverage | 100.00% |
| Average coverage | 42.93% |
| Total occurrences | 1,404,249 |
| Total CVEs | 62,445 |
The page says injection is one of the most tested categories, with 100 percent of applications tested for some form of it, and that it had the greatest number of CVEs of any category. Cross-site scripting is described as high frequency and low impact, with more than 30,000 CVEs. SQL injection is low frequency and high impact, with more than 14,000 CVEs. The very high number of cross-site scripting reports brings down the category's average weighted impact.
Incidence rate and coverage are measures from OWASP's own data collection. Read them as how often the issue was found among tested applications, not as a prediction for your system.
What is inside
Familiar members include:
- Cross-site scripting (CWE-79).
- SQL injection (CWE-89).
- OS command injection (CWE-78) and argument injection (CWE-88).
- LDAP injection (CWE-90), XML injection (CWE-91) and CRLF injection (CWE-93).
- Code injection (CWE-94) and eval injection (CWE-95).
- Improper input validation (CWE-20) and the general injection class (CWE-74). The OWASP page lists the full set.
OWASP also cross-references LLM01:2025 Prompt Injection, since the pattern of data being treated as instructions applies there too. See what is prompt injection for that side.
What OWASP recommends
The page says the main means of prevention is to keep data separate from commands and queries.
- Prefer a safe API that avoids the interpreter, provides a parameterized interface, or uses an ORM. It cautions that stored procedures can still be injectable if they concatenate queries and data.
- When separation is impossible, use positive server-side input validation. It notes this is not complete since many applications need special characters.
- Escape special characters for any remaining dynamic queries using the interpreter's own syntax. It warns that SQL structure names cannot be escaped and that these techniques are error-prone.
For the detailed ranking, see how to prevent injection flaws.
How to use the category in practice
- In training: use the three scenarios on the page (SQL, an ORM query and an OS command) as examples.
- In scan triage: tag findings with CWE IDs and roll them up under A05. Our CWE lookup table helps.
- In customer answers: say which controls you use for each interpreter, rather than claiming coverage of the whole category.
- In planning: because XSS dominates counts, do not let low-impact XSS crowd out the rarer, higher-impact SQL and command flaws.
Using the category for a checklist is fine. Treat it as an awareness list, not a certification of anything.
Quick check
Is cross-site scripting part of injection in the 2025 list?
Yes. A05:2025 Injection includes cross-site scripting among its mapped weaknesses.
Does fixing the Top 10 category mean my app is secure?
No. The Top 10 is an awareness list of common risk categories. It does not cover everything.
Safeguard's free scan at gold.safeguard.sh/scan covers your dependencies, and its compliance and evidence automation can help you keep proof of the checks you run.
Sources
Last reviewed: 19 October 2026.
