YTYK You think you know

Card 11 of 18 The classics, demoted ●●○ Working knowledge

A05: injection fell to fifth, and is not solved

Injection fell from #3 to #5. It remains one of the most tested categories, with the greatest number of CVEs of any entry — roughly 38 CWEs spanning cross-site scripting, high frequency and low impact, and SQL injection, low frequency and high impact.

Why it is like this

The enormous volume of low-impact XSS CVEs drags the category's average weighted impact down. The ranking is an average, so a category full of small findings can fall while still containing your worst one.

Not to be confused with

Evidence that injection is going away. Falling two places here means the average weighting moved, not that the risk did — and no category is more thoroughly tested, which is itself why so much of it is found.

In practice

If you learned "injection is number one", that was 2017. It was #3 in 2021 and is #5 now, and in none of those years did that mean you could stop parameterising queries.

Source: OWASP Top 10:2025 — A05:2025 Injection. Read on .

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.

Predict Check yourself

Injection dropped from #3 to #5. What does that justify concluding?

  1. Very little about your own risk — averaging tens of thousands of low-impact XSS CVEs pulls the category's weighted impact down regardless of how severe injection is in your application.
  2. That injection is largely solved by modern frameworks.
  3. That SQL injection is now rare enough to deprioritise.
  4. That the category will drop off the list in the next edition.
Show the answer

Very little about your own risk — averaging tens of thousands of low-impact XSS CVEs pulls the category's weighted impact down regardless of how severe injection is in your application.

The ranking is an industry-wide average. Your application's risk is not an average of the industry's.