One in four business web applications have at least one high-risk security issue, according to a report.
Analysing the web applications on behalf of its public and private sector clients around the world, NTA Monitor found that 27 per cent of all those tested had a high-risk issue, comparing to 17 per cent the previous year.
NTA looked at a wide range of industry sectors, and saw that the biggest change came with its charity and not-for-profit clients, where the average number of vulnerabilities for each web app more than tripled since last year to 15 per cent.
The sector with the highest number of high-risk vulnerabilities - those that could allow an attacker to gain network access - was services, which had an average of two high-risk flaws per test.
The most secure industry sectors were utilities and legal, as they were the only ones to have no high-level risks.
NTA found that the most common attacks against web application flaws were SQL injection, cross-site scripting and cross-request forgery.
SQL injection was the only one of these that was in the top three high-risk attacks from last year's report.
Roy Hills, technical director at NTA Monitor, said that user-supplied data needed to be cleaned before it was returned to the browser or stored in the database.
"This reduces the threat of SQL injection, which is a consistently prevalent high-risk throughout 2008 and 2009," he said in a statement.
"SQL injection enables attackers to modify the database queries initiated from an application so users can delete, create or update database records."
-
Microsoft Surface Laptop 8 (13.8in) reviewReviews The business model of the Surface Laptop 8 is a Panther Lake beast with long battery life and a privacy display
-
The agents you use to beef up cybersecurity could be turned against youNews Research shows agents can be fooled into executing malicious code while performing security reviews of third-party software
-
OpenAI expands 'Daybreak' cyber program: New tools, partnerships, and a cyber-focused GPT-5.5 aim to help 'patch the world'News The company has added new tools, signed up partners, and released its GPT-5.5-Cyber model more widely
-
AI is shrinking attack windows, and it’s forcing a complete rethink of cyber resilience – here’s how organizations can prepareNews Commvault has urged companies to improve their business continuity and resilience plans in the face of flaws spotted by AI
-
Anthropic targets vulnerability detection gains with Claude Security public beta — here's what users can expectNews The Claude Mythos developer is aiming for a more limited approach to cyber tooling for public consumption
-
Researchers warn millions of RDP and VNC servers are wide open to exploitationNews Researchers at Forescout spotted millions of RDP and VNC servers exposed online
-
Brace yourselves for a vulnerability explosion, Forescout warnsNews AI advances are helping identify software flaws at record pace and scale, but that's not the good news some would think
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
