What you need to know
MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.
Potentially affected
Custom web applications, customer portals, APIs and internal business software developed or maintained in-house or by a contractor, including repair work on inherited code.
DSE recommendation
DSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release.
MITRE’s 2025 CWE Top 25 ranks cross-site scripting, SQL injection and CSRF first, with missing authorization rising five places to fourth. Use the list to decide what every review and test of custom code must cover.
Source facts
The 2025 CWE Top 25 ranks cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. Missing Authorization (CWE-862) is fourth, up five places from ninth in 2024.
Authorization and authentication flaws recur further down the list: Incorrect Authorization (CWE-863) is 17th, Improper Access Control (CWE-284) is a new entry at 19th, Missing Authentication for Critical Function (CWE-306) is 21st, and Authorization Bypass Through User-Controlled Key (CWE-639) rose six places to 24th. Unrestricted Upload of File with Dangerous Type (CWE-434) is 12th.
The list also counts CVEs in CISA’s Known Exploited Vulnerabilities catalog for each weakness. OS Command Injection (CWE-78) has the most, 20, while Missing Authorization and CSRF show none, so a high rank does not by itself mean known exploitation.
Applicability
Use this for web and API code written in any language. The list also includes memory-safety entries, such as out-of-bounds write and use after free, which belong in the review scope whenever a project includes native-code components.
DSE recommendation
DSE recommends turning the web-relevant entries of the 2025 CWE Top 25 into explicit review and test items for every custom-software release. For each route or API, record who may call it and test that the server enforces it; check output encoding, parameterized queries, CSRF protection, file-upload restrictions and command execution paths; and require the contractor’s test report to reference the CWE identifiers covered.
Verification
For a release, confirm the test evidence includes authorization tests with a lower-privileged account and with another user’s record identifiers, injection tests on every input that reaches a query or command, and upload tests with disallowed file types. Re-run the same tests after fixes and keep the results with the release.
Official reference
MITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses. Reviewed October 18, 2026.
Review the official source
MITRE CWE — 2025 CWE Top 25 Most Dangerous Software Weaknesses · Verified October 18, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE