[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a03":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a03","A03:2021","A03:2021 Injection",66,"OWASP Foundation","**What it asks for.** This category covers flaws where untrusted data is sent to an interpreter as part of a command or query, so that an attacker can change its meaning. Examples include SQL, NoSQL, OS command, LDAP and expression language injection. In the 2021 edition, cross-site scripting was merged into this category.\n\n**In practice.** Applications use safe APIs such as parameterised queries, avoid building commands from strings, validate input against allow lists and encode output for the context it is used in. Static and dynamic testing in the pipeline catches regressions. Evidence includes secure coding standards, code review findings, test results and tracked remediation of injection issues.\n\n**Common gaps.** Legacy code and internal tools often still build queries by concatenation. Second order injection, where stored data is later used unsafely, and injection in less common interpreters are frequently missed.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA03_2021-Injection\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"langflow-rce-flaw-actively-exploited-via-unvalidated-command-injection","Langflow RCE Flaw Actively Exploited via Unvalidated Command Injection","2026-10-15T10:21:22.699+00:00",{"slug":23,"title":24,"published_at":25},"stored-xss-in-wordpress-plugins-enables-backdoor-installation-and-admin-account-hijacking","Stored XSS in WordPress Plugins Enables Backdoor Installation and Admin Account Hijacking","2026-10-06T22:21:12.316+00:00",{"slug":27,"title":28,"published_at":29},"ai-agents-probe-government-sites-with-sql-injection-attacks","AI Agents Probe Government Sites with SQL Injection Attacks","2026-10-02T10:21:06.523+00:00",{"slug":31,"title":32,"published_at":33},"autonomous-ai-agents-launch-sql-injection-attacks-against-government-websites","Autonomous AI Agents Launch SQL Injection Attacks Against Government Websites","2026-10-01T22:20:35.648+00:00",{"slug":35,"title":36,"published_at":37},"critical-wordpress-plugin-flaws-demand-immediate-patching","Critical WordPress Plugin Flaws Demand Immediate Patching","2026-10-01T06:21:08.364+00:00",{"slug":39,"title":40,"published_at":41},"microsoft-enforces-csp-to-block-entra-id-script-injection-attacks","Microsoft Enforces CSP to Block Entra ID Script Injection Attacks","2026-09-30T14:20:21.826+00:00",{"slug":43,"title":44,"published_at":45},"sql-injection-in-firewall-component-exposes-22-million-swedes-earns-160k-gdpr-fine","SQL Injection in Firewall Component Exposes 2.2 Million Swedes, Earns €160K GDPR Fine","2026-09-30T08:21:23.896+00:00",{"slug":47,"title":48,"published_at":49},"roundcube-sql-injection-flaw-exploited-despite-available-patches","Roundcube SQL Injection Flaw Exploited Despite Available Patches","2026-09-25T12:21:40.997+00:00",{"slug":51,"title":52,"published_at":53},"critical-sql-injection-in-roundcube-webmail-actively-exploited","Critical SQL Injection in Roundcube Webmail Actively Exploited","2026-09-25T08:20:36.006+00:00",{"slug":55,"title":56,"published_at":57},"fake-cloudflare-pages-on-hacked-ukrainian-sites-spread-psychedelic-stealer","Fake Cloudflare Pages on Hacked Ukrainian Sites Spread Psychedelic Stealer","2026-09-24T21:20:56.441+00:00",{"slug":59,"title":60,"published_at":61},"critical-roundcube-sql-injection-flaw-now-actively-exploited","Critical Roundcube SQL Injection Flaw Now Actively Exploited","2026-09-24T19:20:46.758+00:00",{"slug":63,"title":64,"published_at":65},"nextjs-jsx-to-svg-injection-flaw-demands-immediate-upgrade","Next.js JSX-to-SVG Injection Flaw Demands Immediate Upgrade","2026-09-23T20:20:55.033+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",45,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",39,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",35,{"slug":83,"name":84,"problem":85,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",9,{"slug":88,"name":89,"problem":90,"stories":91},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",8,{"slug":93,"name":94,"problem":95,"stories":96},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",6,[98,104,110,116,120,125,129,134],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","7","Control 7","Continuous Vulnerability Management",62,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",48,{"family":111,"item":112,"code":113,"title":114,"together":115},"nist-800-53","si-2","SI-2","Flaw Remediation",47,{"family":117,"item":118,"code":119,"title":119,"together":81},"itil","overview","ITIL",{"family":111,"item":121,"code":122,"title":123,"together":124},"ra-5","RA-5","Vulnerability Monitoring and Scanning",28,{"family":111,"item":126,"code":127,"title":128,"together":124},"si-10","SI-10","Information Input Validation",{"family":99,"item":130,"code":131,"title":132,"together":133},"2","Control 2","Inventory and Control of Software Assets",26,{"family":99,"item":135,"code":136,"title":137,"together":133},"12","Control 12","Network Infrastructure Management"]