OWASP Top 10:2025
Injection

OWASP Top 10:2025 OWASPTOP10-3: A03:2025 Injection Including Cross-Site Scripting

Address OWASP Top 10 A03 Injection per OWASP Top 10:2025. Injection occurs when untrusted data is sent to an interpreter as part of a command or query enabling SQL injection + NoSQL injection + LDAP injection + OS command injection + ORM injection + XML/XPath injection + Server-Side Template Injection (SSTI) + Cross-Site Scripting (XSS) + and other injection variants. Mitigations include (a) validate + sanitise + escape input at trust boundaries + (b) use parameterised queries + prepared statements + ORM safe-query APIs against SQL/NoSQL injection + (c) use context-appropriate output encoding against XSS (HTML + URL + JS + CSS encoding) + (d) implement Content Security Policy + Trusted Types + (e) validate file uploads (type + size + content + scanning) + (f) protect against XXE + deserialisation + template injection via safe parser configuration.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 45 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CWE Top 25 Most Dangerous Software Weaknesses (2024) · 6 controls

  • CWE-20 Improper Input Validation
  • CWE-77 Improper Neutralization of Special Elements used in a Command (Command Injection)
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
  • CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
  • CWE-94 Improper Control of Generation of Code (Code Injection)

IEEE 1686 · 3 controls

  • IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills
  • IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability
  • IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper

NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production · 3 controls

  • AQAP2110-1 Quality Management System Aligned to ISO 9001 plus NATO Supplementary Requirements
  • AQAP2110-2 Government Quality Assurance Representative (GQAR) Authority and Access
  • AQAP2110-6 Subcontractor Supply Chain Control plus Counterfeit Material Prevention

GS1 Global Standards - Supply Chain Traceability and Data Security · 2 controls

German Supply Chain Due Diligence Act (LkSG) · 2 controls

Modern Slavery Act 2018 (Australia) · 2 controls

OWASP DevSecOps Maturity Model (DSOMM) · 2 controls

  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing

FDA Quality Management System Regulation (QMSR) · 1 control

FedRAMP Rev 5 · 1 control

  • FedRAMP-SupplyChain-SBOM FedRAMP supply chain risk management + SBOM (per EO 14028 + NIST 800-218 SSDF)

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

GAMP 5 - Good Automated Manufacturing Practice · 1 control

  • GAMP5-2nd-Edition-AI-Cloud-Agile-CSA 2nd Edition (2022) - AI/ML, Cloud, Agile, DevOps and Computer Software Assurance (CSA)

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

  • GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IATF 16949:2016 - Quality Management System for Automotive Production · 1 control

  • IATF16949-Clause8-Supplier-QMS-Development-Externally-Provided IATF 16949 Clause 8 Supplier - Control of Externally Provided Processes + Type and Extent + Supplier QMS Development

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

ICH Q10 - Pharmaceutical Quality System · 1 control

IRM/AIRMIC/ALARM A Risk Management Standard (2002) · 1 control

  • IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

  • A.1 Point-of-Care Testing Additional Requirements

ISO/IEC 27010:2015 · 1 control

  • 27010-15.1 Incident Management

ISO/IEC 27011:2024 · 1 control

  • 27011-5.6 Supplier relationships and telecom supply chain

NERC CIP · 1 control

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update) · 1 control

  • OECDMNE-5 Environment, Climate, and Biodiversity

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08)

Ontario Accessibility for Ontarians with Disabilities Act (AODA) - IASR Web Standard · 1 control

  • AODACAN-2 Accessible Procurement of Goods, Services, Facilities

SQF Code Edition 9 - Safe Quality Food · 1 control

  • 2.7.2 Food Fraud Plan

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 45 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll OWASP Top 10:2025 controls