CWE and CWE Top 25

1. CWE-79 Cross-site Scripting

   Improper neutralization of input during web page generation.

2. CWE-89 SQL Injection

   Improper neutralization of special elements in SQL commands.

3. CWE-352 Cross-Site Request Forgery

   Missing validation that requests were intentionally made by the user.

4. CWE-862 Missing Authorization

   Missing authorization checks on actions or resources.

5. CWE-787 Out-of-bounds Write

   Writing past the end or before the start of a buffer.

6. CWE-22 Path Traversal

   Improper limitation of a pathname to a restricted directory.

7. CWE-416 Use After Free

   Referencing memory after it has been freed.

8. CWE-125 Out-of-bounds Read

   Reading beyond buffer boundaries.

9. CWE-78 OS Command Injection

   Improper neutralization of special elements in OS commands.

10. CWE-94 Code Injection

    Improper control of generation of code.

11. CWE-434 Unrestricted File Upload

    Upload of files with dangerous types.

12. CWE-502 Deserialization of Untrusted Data

    Deserializing attacker-controlled data.

13. CWE-863 Incorrect Authorization

    Authorization checks performed incorrectly.

14. CWE-918 Server-Side Request Forgery

    Server fetches attacker-chosen URLs.

15. CWE Top 25 Most Dangerous Software Weaknesses

    The full ranked list, methodology and scoring of the 2025 CWE Top 25.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• CAPEC
• CISA Known Exploited Vulnerabilities Catalog
• CVE Program
• CVSS
• EPSS
• MITRE ATT&CK Enterprise
• MITRE D3FEND
• National Vulnerability Database