---
title: "What is Application Security Vulnerability: Definition"
date: "2014-07-16T13:38:11+00:00"
url: "https://staging.checkmarx.com/glossary/application-vulnerability/"
description: "Untested apps expose sensitive data. We define application security vulnerabilities and outline how they lead to software security issues."
---

# What is Application Security Vulnerability: Definition

Malicious attackers have now turned their focus towards application layer vulnerabilities. Approximately 90% of all security vulnerabilities found in software code are located in the application layer. Applications that are not properly tested have a risk of containing vulnerabilities that can be exploited by the attackers to gain privileged access and harvest information. Vulnerabilities are dangerous to companies as they can enable malicious attackers to gain access to company accounts, sensitive financial data, customer and client contact information, social security numbers, credit card numbers and other information that can be used for personal or financial gain. Some of the most common vulnerabilities today include:

- [SQL Injection](https://checkmarx.com/learn/application-security/sql-injection/)
- [Insecure Cryptographic Storage](https://checkmarx.com/glossary/insecure-cryptographic-storage/)
- [LDAP Injection](https://checkmarx.com/glossary/ldap-injection-tutorial/)
- [Cross-Site Scripting](https://checkmarx.com/glossary/cross-site-scripting-xss-attacks/)
- [Cross-Site Request Forgery](https://checkmarx.com/glossary/cross-site-request-forgery-csrf-attacks/)

**How to avoid and eliminate security vulnerabilities in applications**
Penetration (Pen) Testing is one of the oldest security solutions, still being used by organizations worldwide. While being an effective solution, its not involved in the development process and vulnerabilities are found in the latter stages of the development process. This is obviously not the ideal thing for organizations using Agile or DevOps methodologies, which are becoming more and more common. Another problem with Pen Testing is that multiple cycles are required to achieve comprehensive coverage, something that can cost a whole lot of money.

![application security vulnerability absteact](https://staging.checkmarx.com/wp-content/uploads/2025/01/vulnerabilities_3x-1024x595.webp)
Dynamic Application Security Testing ([DAST](https://checkmarx.com/checkmarx-dast/)) and [Static Application Security Testing](https://checkmarx.com/learn/sast/static-application-security-testing-sast/) (SAST) have become the go-to security solutions for most organizations today. The latter provides the edge since it doesn’t require a build to start working. Its also better in locating non-reflective vulnerabilities (i.e. – [XSS](https://checkmarx.com/glossary/cross-site-scripting-xss-attacks/)). Using a [SAST solution](https://checkmarx.com/cxsast-source-code-scanning/), like Static Code Analysis ([SCA](https://checkmarx.com/cxsca-open-source-scanning/)), can help the organization build the security solution within the developer’s IDE. This integration of the security into the developers environment helps treat security bugs like QA bugs, with everyone involved in the process.

**Learn more about application security vulnerabilities in [Vulnerability Knowledge Base](https://checkmarx.com/zero/vulnerabilities/).**