OWASP stands for the Open Web Application Security Project. It is a non-profit global online community consisting of tens of thousands of members and hundreds of chapters that produces articles, documentation, tools and technologies in the field of web application security.
- OWASP releases the Top 10 Web Application Security Risks every 3-4 years based on real-world vulnerability data.
- The list is created using frequency, severity and impact of security flaws found in web applications..
Note: As of 2025, the OWASP Top 10 (2021) remains the latest official release. OWASP has not published a newer Top 10 list yet. This article reflects the current OWASP Top 10 that is still valid and widely used in 2025.
1. Broken Access Control
Broken Access Control occurs when authorization is improperly enforced, allowing users to access or modify resources beyond their assigned privileges.
- Lack of access controls in PUT, POST, DELETE in APIs.
- Any kind of tampering with JSON web tokens to elevate privileges like changing roles from 'user' to 'admin'.
Example: If an application used the URL of the format:
http://example.com/object/12345%3C/span>The reference ID 12345 could be changed to 123456 and the user could simply access the other object with that id.
2. Cryptographic Failures
Cryptographic Failures occur when sensitive data is inadequately protected due to weak, missing or improperly implemented cryptographic controls.
- Old or weak cryptographic measures being used by default in a system.
- Data transmission without being encrypted, use of protocols such as HTTP, SMTP, FTP.
- Server certificate and trust chain is not verified properly.
3. Injection
Injection occurs when untrusted input is interpreted as executable commands or queries, leading to unauthorized code execution or data manipulation.
- It directly adds user input into SQL or command strings, which mixes trusted code with untrusted data.
- It uses user input in ORM queries, letting attackers fetch data they shouldn't access..
Example of an Injection Vulnerability
The code for querying in the backend of the application
SELECT * FROM users WHERE username = '$username' AND password = '$password';The attacker inputs the username and password as
Username: admin
Password: ' OR '1'='1
Now, the resultant query will be
SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1';Given that the condition '1'='1' is true, the query will be successfully carried out and the user gained access to system.
4. Insecure Design
Insecure Design results from architectural and design flaws that introduce security weaknesses before implementation.
5. Security Misconfiguration
Security Misconfiguration results from insecure default settings, improper configurations or missing security controls that expose applications and infrastructure to attack.
- Use of default credentials by an account.
- Outdated software.
- Insecure security settings like libraries, databases, application frameworks.
6. Vulnerable & Outdated Components
Vulnerable and Outdated Components arise from the use of software, libraries, frameworks or dependencies with known security vulnerabilities.
- Lack of information about all the components including client and server side, including direct and nested dependencies.
- Vulnerable or outdated software, including databases, OS, servers, DBMS, APIs, runtime environments, libraries and all other components of an application.
7. Identification & Authentication Failures
Identification and Authentication Failures occur when authentication or session management weaknesses allow unauthorized access or account compromise.
- Automated attacks like credential stuffing, brute-force attacks to gain unauthorized access to a system
- Default and weak credentials are allowed by any system
- Lack of Multi-factor authentication
8. Software and Data Integrity Failures
Software and Data Integrity Failures occur when software, updates or data cannot be verified for integrity, enabling unauthorized modification or supply chain compromise.
- Untrusted sources of dependencies for plugins, libraries, modules
- Insecure CI/CD pipeline leading to unauthorized access, malware upload or system compromise
9. Security Logging and Monitoring Failures
Security Logging and Monitoring Failures occur when inadequate logging, monitoring or alerting delays the detection and response to security incidents.
- Centralize Logs: Aggregate logs from applications, servers, databases and network devices into a SIEM for correlation and threat detection.
- Enable Real-Time Alerts: Monitor authentication failures, privilege escalation, configuration changes and log tampering for immediate incident response.
10. Server-Side Request Forgery
Server-Side Request Forgery (SSRF) occurs when an application fetches user-supplied URLs without validation, allowing attackers to access internal or external resources.
- Validate Outbound Requests: Restrict requests using allowlists, URL validation and network filtering to prevent access to internal or unauthorized resources.
- Monitor Outbound Traffic: Detect unusual server-initiated requests to internal IP ranges, cloud metadata services or unexpected external hosts.
