A05:2025: Injection
SQL injection, command injection, LDAP injection, NoSQL injection, XSS (reflected/stored/DOM), template injection. XSS is included as injection.
How it's found
Identified by fuzzing input parameters and reviewing source code for unsanitized data reaching SQL, command, or HTML/JS sinks.
Vulnerable vs. safe
db.query(`SELECT * FROM users WHERE email = '${email}'`);db.query('SELECT * FROM users WHERE email = $1', [email]);Standards mapping
- References
- https://owasp.org/Top10/2025/
How TurboPentest tests for this
TurboPentest's automated black-box pentest actively probes for Cross-site Scripting using Web Scanner and Vuln Scanner, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 18 dedicated rules for this weakness.
Tools: Web Scanner, Vuln Scanner
Frequently asked questions
What is A05:2025 Injection?
SQL injection, command injection, LDAP injection, NoSQL injection, XSS (reflected/stored/DOM), template injection. XSS is included as injection.
How do you find Injection?
Identified by fuzzing input parameters and reviewing source code for unsanitized data reaching SQL, command, or HTML/JS sinks.
Which CWEs map to A05:2025?
A05:2025 maps to CWE-79, CWE-89, CWE-78.
Does TurboPentest test for Injection?
TurboPentest's automated black-box pentest actively probes for Cross-site Scripting using Web Scanner and Vuln Scanner, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 18 dedicated rules for this weakness.
Related OWASP categories
- OWASP Top 10 (Web)A01:2025: Broken Access Control
- OWASP Top 10 (Web)A02:2025: Security Misconfiguration
- OWASP Top 10 (Web)A03:2025: Software Supply Chain Failures
- OWASP Top 10 (Web)A04:2025: Cryptographic Failures
- OWASP Top 10 (Web)A06:2025: Insecure Design
- OWASP Top 10 (Web)A07:2025: Identification and Authentication Failures
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest