MITRE's 2025 top software weaknesses list: XSS, SQL injection, and buffer overflows threaten European data security

MITRE released its 2025 Common Weakness Enumeration Top 25 list, based on 39,080 CVE records. Cross-site scripting remains the top weakness, followed by SQL injection and CSRF, with buffer overflow issues entering the list. CISA recommends software makers adopt Secure by Design practices. For European organisations, these vulnerabilities risk GDPR fines and operational disruption, per OffSeq analysis.

Bottom line — The list, based on 39,080 CVEs, should guide European firms' security investments and vendor evaluations per CISA.

Go deeper (7)

• Cross-site scripting (XSS) kept the top spot, followed by SQL injection and cross-site request forgery (CSRF), each up one position from last year, per SecurityWeek.
• Six new entries include three buffer overflow weaknesses (classic, stack-based, heap-based) and improper access control, according to MITRE.
• The list is based on 39,080 CVE records, per MITRE, and is intended to support vulnerability reduction and cost efficiency, per CISA.
• CISA recommends software makers review the list and incorporate Secure by Design practices, and that security teams use it for vulnerability management and vendor benchmarking.
• For European organisations, exploitation of XSS and SQL injection can lead to data breaches involving personal data protected under GDPR, resulting in legal and financial penalties, the OffSeq analysis notes.
• Memory safety issues like buffer overflows are prompting adoption of safer languages like Rust, per Cyber Security News.
• Improper privilege management and integer overflow dropped from the list, influenced by changes in calculation methodology, per SecurityWeek.

Read the reporting