A05:2025: Injection
SQL injection, command injection, LDAP injection, NoSQL injection, XSS (reflected/stored/DOM), template injection. XSS is included as injection.
How it's found
Identified by fuzzing input parameters and reviewing source code for unsanitized data reaching SQL, command, or HTML/JS sinks.
Vulnerable vs. safe
db.query(`SELECT * FROM users WHERE email = '${email}'`);db.query('SELECT * FROM users WHERE email = $1', [email]);Standards mapping
- References
- https://owasp.org/Top10/2025/
How TurboPentest tests for this
TurboPentest's automated black-box pentest actively probes for Cross-site Scripting using OWASP ZAP and Nuclei, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 18 dedicated rules for this weakness.
Tools: OWASP ZAP, Nuclei
Frequently asked questions
What is A05:2025 Injection?
SQL injection, command injection, LDAP injection, NoSQL injection, XSS (reflected/stored/DOM), template injection. XSS is included as injection.
How do you find Injection?
Identified by fuzzing input parameters and reviewing source code for unsanitized data reaching SQL, command, or HTML/JS sinks.
Which CWEs map to A05:2025?
A05:2025 maps to CWE-79, CWE-89, CWE-78.
Does TurboPentest test for Injection?
TurboPentest's automated black-box pentest actively probes for Cross-site Scripting using OWASP ZAP and Nuclei, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 18 dedicated rules for this weakness.
Related OWASP categories
- OWASP Top 10 (Web)A01:2025: Broken Access Control
- OWASP Top 10 (Web)A02:2025: Security Misconfiguration
- OWASP Top 10 (Web)A03:2025: Software Supply Chain Failures
- OWASP Top 10 (Web)A04:2025: Cryptographic Failures
- OWASP Top 10 (Web)A06:2025: Insecure Design
- OWASP Top 10 (Web)A07:2025: Identification and Authentication Failures
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest