SQL injection is the leading critical web-application risk in Q3 2021

Edgescan, the full-stack vulnerability-management provider, has released its Q3 Vulnerability Snapshot, a short report describing the current vulnerability landscape based on thousands of assessments conducted worldwide.

Compiled by Edgescan CEO Eoin Keary, the findings highlight how cybercriminals' preferred vulnerabilities change.

This quarterly report already suggests the 2022 Vulnerability Statistics report will underline the changing attack surface and, once again, the importance of Attack Surface Management.

Critical web-application risks

The leading critical risk for Q3 is SQL Injection (A03:2021-Injection), which has increased compared with Q2 and Q1. Q3 also saw an increase in stored Cross-Site Scripting, although still below the Q1 level of 37%, showing that it is resurfacing.

High web-application risks

At present, 51% of high web-application risks fall under Injection (A03:2021-Injection), followed by Broken Access Control (A01:2021-Broken Access Control) at 21%. Reflected Cross-Site Scripting (XSS) is the leading cause both this quarter and last quarter.