Study. uk . com
  1. Home
  2. All questions
  3. Question 464

CISSP study material · question 464 of 500

Which description matches OWASP's 2025 definition of an injection vulnerability?

  1. An application exposes an internal object reference that an attacker can manipulate.
  2. An application trusts a client-side check that an attacker can bypass.
  3. An application fails to encode output, allowing a browser to render attacker-supplied markup.
  4. Untrusted input reaches an interpreter and part of it is executed as a command rather than treated as data.
Show the answer

Answer: D. Untrusted input reaches an interpreter and part of it is executed as a command rather than treated as data.

The flaw lets untrusted input reach an interpreter, which then treats part of what arrived as instructions rather than as ordinary data.

Source: OWASP Top 10 A05:2025 (OWASP) — OWASP Top 10:2025 A05 Injection > Description

Challenge yourself on this topic → Study as cards