La Agencia de Seguridad de Infraestructura y Ciberseguridad (CISA), en colaboración con el Instituto de Desarrollo e Ingeniería de Sistemas de Seguridad Nacional (HSSEDI), operado por MITRE, de los Estados Unidos, ha publicado “2025 CWE Top 25 Most Dangerous Software Weaknesses“.
La lista identifica las debilidades de software más críticas que los ciberatacantes pueden aprovechar para comprometer los sistemas, robar datos confidenciales o interrumpir servicios esenciales.
Es recomendable que las organizaciones se apoyen en alista para revisar sus estrategias de seguridad de software. Dar prioridad a estas debilidades en los procesos de desarrollo y adquisición ayuda a prevenir vulnerabilidades en el núcleo del ciclo de vida del software.
La siguiente es la lista de las debilidades más peligrosas de software de 2025:
| Rank | ID | Name |
|---|---|---|
| 1 | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
| 2 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| 3 | CWE-352 | Cross-Site Request Forgery (CSRF) |
| 4 | CWE-862 | Missing Authorization |
| 5 | CWE-787 | Out-of-bounds Write |
| 6 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
| 7 | CWE-416 | Use After Free |
| 8 | CWE-125 | Out-of-bounds Read |
| 9 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
| 10 | CWE-94 | Improper Control of Generation of Code (‘Code Injection’) |
| 11 | CWE-120 | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) |
| 12 | CWE-434 | Unrestricted Upload of File with Dangerous Type |
| 13 | CWE-476 | NULL Pointer Dereference |
| 14 | CWE-121 | Stack-based Buffer Overflow |
| 15 | CWE-502 | Deserialization of Untrusted Data |
| 16 | CWE-122 | Heap-based Buffer Overflow |
| 17 | CWE-863 | Incorrect Authorization |
| 18 | CWE-20 | Improper Input Validation |
| 19 | CWE-284 | Improper Access Control |
| 20 | CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor |
| 21 | CWE-306 | Missing Authentication for Critical Function |
| 22 | CWE-918 | Server-Side Request Forgery (SSRF) |
| 23 | CWE-77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) |
| 24 | CWE-639 | Authorization Bypass Through User-Controlled Key |
| 25 | CWE-770 | Allocation of Resources Without Limits or Throttling |