CWE Top 25 Most Dangerous Software Weaknesses 2025 report
This report references the 2025 CWE Top 25 Most Dangerous Software Weaknesses list. This list, published by the CWE Team, highlights the most severe and prevalent weaknesses based on an analysis of Common Vulnerabilities and Exposures (CVE) records from the National Vulnerability Database (NVD). This information reflects the integration of the 2025 list into AppScan Enterprise.
Why it matters
The 2025 CWE Top 25 list identifies critical software weaknesses that are frequently discovered and can have severe impacts. Understanding these weaknesses helps developers, testers, project managers, and security professionals prevent vulnerabilities.
These weaknesses are particularly dangerous because they're often easy for adversaries to find and exploit, potentially leading to system compromise, data theft, or application failure. To create the 2025 list, the CWE Team analyzed 39,080 CVE® records from the NIST National Vulnerability Database (NVD), using Common Vulnerability Scoring System (CVSS) data to rank weaknesses by observed prevalence and severity.
| ID | Name |
|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| CWE-352 | Cross-Site Request Forgery (CSRF) |
| CWE-862 | Missing Authorization |
| CWE-787 | Out-of-bounds Write |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CWE-416 | Use After Free |
| CWE-125 | Out-of-bounds Read |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
| CWE-434 | Unrestricted Upload of File with Dangerous Type |
| CWE-476 | NULL Pointer Dereference |
| CWE-121 | Stack-based Buffer Overflow |
| CWE-502 | Deserialization of Untrusted Data |
| CWE-122 | Heap-based Buffer Overflow |
| CWE-863 | Incorrect Authorization |
| CWE-20 | Improper Input Validation |
| CWE-284 | Improper Access Control |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor |
| CWE-306 | Missing Authentication for Critical Function |
| CWE-918 | Server-Side Request Forgery (SSRF) |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| CWE-639 | Authorization Bypass Through User-Controlled Key |
| CWE-770 | Allocation of Resources Without Limits or Throttling |
Related information
For more details on the 2025 CWE Top 25 Most Dangerous Software Weaknesses list, including methodology and descriptions, visit: CWE - 2025 CWE Top 25 Most Dangerous Software Weaknesses