Study. uk . com
  1. Home
  2. All questions
  3. Question 465

CISSP study material · question 465 of 500

Why does OWASP's 2025 injection entry have a lower average weighted impact than the severity of SQL injection alone would suggest?

  1. SQL injection is scored separately and excluded from the category average.
  2. The very large number of cross-site scripting CVEs, a high-frequency but low-impact form, pulls the category average down.
  3. Injection findings are usually remediated before a CVE is issued.
  4. The impact score counts only vulnerabilities with a public exploit.
Show the answer

Answer: B. The very large number of cross-site scripting CVEs, a high-frequency but low-impact form, pulls the category average down.

OWASP notes the massive number of reported cross-site scripting CVEs, described as high frequency and low impact, brings down the average weighted impact of the injection category.

Source: OWASP Top 10 A05:2025 (OWASP) — OWASP Top 10:2025 A05 Injection > Background

Challenge yourself on this topic → Study as cards