OWASP A05:2025 — Injection: Python Security Testing Skill

Overview

Injection occurs when untrusted user input reaches an interpreter — a database, OS shell, template engine, or browser — and is executed as part of a command or query. Despite dropping from #3 to #5 in 2025, Injection carries the most CVEs of any OWASP category: 62,445, including 30,000+ for XSS alone.

Injection types covered by this skill:

• SQL Injection (SQLi) — CWE-89
• Cross-Site Scripting (XSS) — CWE-79
• Server-Side Template Injection (SSTI) — CWE-94
• OS Command Injection — CWE-78 / CWE-77
• ORM Injection
• Input Validation failures — CWE-20
• LLM Prompt Injection (related class, noted in OWASP 2025)