# Aim custom web-app code review at the 2025 CWE Top 25, starting with injection and authorization

> MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.

- Canonical URL: https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-18T21:00:07+00:00
- Modified: 2026-10-18T22:22:06+00:00
- Last reviewed by DSE: 2026-10-18
- Resource type: Checklist
- DSE priority: Advisory
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.

## Potentially affected

Custom web applications, customer portals, APIs and internal business software developed or maintained in-house or by a contractor, including repair work on inherited code.

## DSE recommendation

DSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release.

## Article

MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.

## Source facts

The [2025 CWE Top 25](https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html) ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. Missing Authorization (CWE-862) is fourth, up five places from ninth in 2024.

Authorization and authentication flaws recur further down the list: Incorrect Authorization (CWE-863) is 17th, Improper Access Control (CWE-284) is a new entry at 19th, Missing Authentication for Critical Function (CWE-306) is 21st, and Authorization Bypass Through User-Controlled Key (CWE-639) rose six places to 24th. Unrestricted Upload of File with Dangerous Type (CWE-434) is 12th.

The list also counts CVEs in CISA’s Known Exploited Vulnerabilities catalog for each weakness. OS Command Injection (CWE-78) has the most, 20, while Missing Authorization and CSRF show none, so a high rank does not by itself mean known exploitation.

## Applicability

Use this for web and API code written in any language. The list also includes memory-safety entries, such as out-of-bounds write and use after free, which belong in the review scope whenever a project includes native-code components.

## DSE recommendation

DSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release. For each route or API, record who may call it and test that the server enforces it; check output encoding, parameterized queries, CSRF protection, file-upload restrictions and command execution paths; and require the contractor’s test report to reference the CWE identifiers covered.

## Verification

For a release, confirm the test evidence includes authorization tests with a lower-privileged account and with another user’s record identifiers, injection tests on every input that reaches a query or command, and upload tests with disallowed file types. Re-run the same tests after fixes and keep the results with the release.

## Official reference

[MITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses](https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html). Reviewed October 18, 2026.

## Primary reference

- Name: MITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses
- Authority: cwe.mitre.org
- URL: https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Aim custom web-app code review at the 2025 CWE Top 25, starting with injection and authorization,” DSE Security, https://update.dsesecurity.com/updates/cwe-top-25-2025-custom-web-app-code-review-priorities/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.