Injection
Was 3rd in 2021 and is 5th in 2025, still one of the most tested classes. OWASP maps 38 CWEs and the largest associated CVE count. The category runs from frequent, often lower-impact XSS to less frequent, higher-impact SQL injection. Name the interpreter…
OWASP rank: 5
Practical checks
- Name the context first: HTML, attribute, URL, SQL, NoSQL, command, template, or header
- Use a marker you can grep before any exploit string
- Keep SQL and command tests on rows and features you own
- Treat XSS as a gadget until it reads a session, a token, or an admin view
- Record the parser that accepted the input, not only the payload that fired