Which of the following is not included in the OWASP Top Ten web application security threats? Response:

Injection, such as SQL injection, is a well-known and consistently ranked threat in the OWASP Top Ten.

Cross-site scripting (XSS) is a prevalent web application vulnerability and a recurring entry in the OWASP Top Ten.

Internal theft, while a general security concern for organizations, is not specifically listed as one of the top web application security threats in the OWASP Top Ten, which focuses on vulnerabilities inherent to web application design and implementation.

Sensitive data exposure is a significant concern for web applications and is explicitly included in the OWASP Top Ten.