MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.
\nThe 2025 CWE Top 25 ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. Missing Authorization (CWE-862) is fourth, up five places from ninth in 2024.
\nAuthorization and authentication flaws recur further down the list: Incorrect Authorization (CWE-863) is 17th, Improper Access Control (CWE-284) is a new entry at 19th, Missing Authentication for Critical Function (CWE-306) is 21st, and Authorization Bypass Through User-Controlled Key (CWE-639) rose six places to 24th. Unrestricted Upload of File with Dangerous Type (CWE-434) is 12th.
\nThe list also counts CVEs in CISA’s Known Exploited Vulnerabilities catalog for each weakness. OS Command Injection (CWE-78) has the most, 20, while Missing Authorization and CSRF show none, so a high rank does not by itself mean known exploitation.
\nUse this for web and API code written in any language. The list also includes memory-safety entries, such as out-of-bounds write and use after free, which belong in the review scope whenever a project includes native-code components.
\nDSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release. For each route or API, record who may call it and test that the server enforces it; check output encoding, parameterized queries, CSRF protection, file-upload restrictions and command execution paths; and require the contractor’s test report to reference the CWE identifiers covered.
\nFor a release, confirm the test evidence includes authorization tests with a lower-privileged account and with another user’s record identifiers, injection tests on every input that reaches a query or command, and upload tests with disallowed file types. Re-run the same tests after fixes and keep the results with the release.
\nMITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses. Reviewed October 18, 2026.
", "content_text": "MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.\nSource facts\nThe 2025 CWE Top 25 ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. Missing Authorization (CWE-862) is fourth, up five places from ninth in 2024.\nAuthorization and authentication flaws recur further down the list: Incorrect Authorization (CWE-863) is 17th, Improper Access Control (CWE-284) is a new entry at 19th, Missing Authentication for Critical Function (CWE-306) is 21st, and Authorization Bypass Through User-Controlled Key (CWE-639) rose six places to 24th. Unrestricted Upload of File with Dangerous Type (CWE-434) is 12th.\nThe list also counts CVEs in CISA’s Known Exploited Vulnerabilities catalog for each weakness. OS Command Injection (CWE-78) has the most, 20, while Missing Authorization and CSRF show none, so a high rank does not by itself mean known exploitation.\nApplicability\nUse this for web and API code written in any language. The list also includes memory-safety entries, such as out-of-bounds write and use after free, which belong in the review scope whenever a project includes native-code components.\nDSE recommendation\nDSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release. For each route or API, record who may call it and test that the server enforces it; check output encoding, parameterized queries, CSRF protection, file-upload restrictions and command execution paths; and require the contractor’s test report to reference the CWE identifiers covered.\nVerification\nFor a release, confirm the test evidence includes authorization tests with a lower-privileged account and with another user’s record identifiers, injection tests on every input that reaches a query or command, and upload tests with disallowed file types. Re-run the same tests after fixes and keep the results with the release.\nOfficial reference\nMITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses. Reviewed October 18, 2026.", "content_markdown": "MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.\n\n## Source facts\n\nThe [2025 CWE Top 25](https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html) ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. Missing Authorization (CWE-862) is fourth, up five places from ninth in 2024.\n\nAuthorization and authentication flaws recur further down the list: Incorrect Authorization (CWE-863) is 17th, Improper Access Control (CWE-284) is a new entry at 19th, Missing Authentication for Critical Function (CWE-306) is 21st, and Authorization Bypass Through User-Controlled Key (CWE-639) rose six places to 24th. Unrestricted Upload of File with Dangerous Type (CWE-434) is 12th.\n\nThe list also counts CVEs in CISA’s Known Exploited Vulnerabilities catalog for each weakness. OS Command Injection (CWE-78) has the most, 20, while Missing Authorization and CSRF show none, so a high rank does not by itself mean known exploitation.\n\n## Applicability\n\nUse this for web and API code written in any language. The list also includes memory-safety entries, such as out-of-bounds write and use after free, which belong in the review scope whenever a project includes native-code components.\n\n## DSE recommendation\n\nDSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release. For each route or API, record who may call it and test that the server enforces it; check output encoding, parameterized queries, CSRF protection, file-upload restrictions and command execution paths; and require the contractor’s test report to reference the CWE identifiers covered.\n\n## Verification\n\nFor a release, confirm the test evidence includes authorization tests with a lower-privileged account and with another user’s record identifiers, injection tests on every input that reaches a query or command, and upload tests with disallowed file types. Re-run the same tests after fixes and keep the results with the release.\n\n## Official reference\n\n[MITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses](https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/", "url": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Aim custom web-app code review at the 2025 CWE Top 25, starting with injection and authorization", "item": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/#article", "identifier": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/", "url": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/", "headline": "Aim custom web-app code review at the 2025 CWE Top 25, starting with injection and authorization", "description": "MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list…", "abstract": "MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.", "articleBody": "MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.\nSource facts\nThe 2025 CWE Top 25 ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. Missing Authorization (CWE-862) is fourth, up five places from ninth in 2024.\nAuthorization and authentication flaws recur further down the list: Incorrect Authorization (CWE-863) is 17th, Improper Access Control (CWE-284) is a new entry at 19th, Missing Authentication for Critical Function (CWE-306) is 21st, and Authorization Bypass Through User-Controlled Key (CWE-639) rose six places to 24th. Unrestricted Upload of File with Dangerous Type (CWE-434) is 12th.\nThe list also counts CVEs in CISA’s Known Exploited Vulnerabilities catalog for each weakness. OS Command Injection (CWE-78) has the most, 20, while Missing Authorization and CSRF show none, so a high rank does not by itself mean known exploitation.\nApplicability\nUse this for web and API code written in any language. The list also includes memory-safety entries, such as out-of-bounds write and use after free, which belong in the review scope whenever a project includes native-code components.\nDSE recommendation\nDSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release. For each route or API, record who may call it and test that the server enforces it; check output encoding, parameterized queries, CSRF protection, file-upload restrictions and command execution paths; and require the contractor’s test report to reference the CWE identifiers covered.\nVerification\nFor a release, confirm the test evidence includes authorization tests with a lower-privileged account and with another user’s record identifiers, injection tests on every input that reaches a query or command, and upload tests with disallowed file types. Re-run the same tests after fixes and keep the results with the release.\nOfficial reference\nMITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:07+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Aim custom web-app code review at the 2025 CWE Top 25, starting with injection and authorization" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Checklist", "Advisory priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 328, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "MITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses", "url": "https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html" } } ] } }