I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection.
XML External Entity is an attack that manipulates the XML parser/interpreter, to achieve information disclosure of some data (i.e., a file from the file system).
SQL Injection is an attack that manipulates the SQL interpret to achieve a wide range of goals, one of which might be information disclosure of some data.
Some organizations have even called XXE an Injection attack, and OWASP does list XML Injection under A1. While I would argue that with XXE you are not technically injecting any commands into an interpreter, the data flow for both categories is essentially the same:
So, what would you argue is the main reason for this division? Is it simply to raise awarness for XXE in particular, or can it really be classified as standalone?
I'd argue that even XXS can be treated as Injection, but I can accept that the distinction here is that the system isn't attacked, but its users.