Haxoris Wiki

WEB - OWASP TOP 10

The OWASP Top 10 is the gold standard for web application security, outlining the most critical security risks that modern applications face. Published by the Open Web Application Security Project (OWASP), this list is continuously updated to reflect the latest threats, attack techniques, and vulnerabilities that put businesses and users at risk. This section follows the OWASP Top 10:2025 release. Whether you’re a developer, security professional, or business owner, understanding these risks is essential to protecting your applications and data.

The 2025 Categories

  • A01: Broken Access Control – Missing or bypassable authorization, including SSRF, which the 2025 list folds into this category.
  • A02: Security Misconfiguration – Insecure defaults, exposed configurations, missing hardening, XXE, and weak cookie or header settings.
  • A03: Software Supply Chain Failures – Vulnerable dependencies plus the build, packaging, and distribution pipeline around them.
  • A04: Cryptographic Failures – Weak or missing encryption, poor key management, and sensitive data exposed in transit or at rest.
  • A05: Injection – SQL, command, and code injection, along with Cross-Site Scripting (XSS).
  • A06: Insecure Design – Architectural and business-logic flaws, missing anti-automation, and unbounded resource use.
  • A07: Authentication Failures – Weak credentials, missing MFA, brute-forceable logins, and broken session handling.
  • A08: Software or Data Integrity Failures – Unverified updates, insecure deserialization, and tampering with critical data.
  • A09: Security Logging and Alerting Failures – Gaps in logging, detection, and the alerting that turns a log entry into a response.
  • A10: Mishandling of Exceptional Conditions – Crashes, information-leaking errors, fail-open logic, and half-completed transactions.

What Changed From the 2021 List

  • Software Supply Chain Failures replaces and widens Vulnerable and Outdated Components, covering CI/CD pipelines, build systems, and package distribution rather than dependency versions alone.
  • Mishandling of Exceptional Conditions is entirely new, gathering error-handling and fail-open weaknesses that were previously scattered across other categories.
  • Server-Side Request Forgery (SSRF) is no longer a standalone entry — it is consolidated into Broken Access Control.
  • Security Misconfiguration rose to second place, reflecting how much of today’s risk comes from deployment and configuration rather than code.
  • Identification and Authentication Failures is now simply Authentication Failures, and Security Logging and Monitoring Failures became Security Logging and Alerting Failures to stress detection and response over passive collection.

Each of these vulnerabilities presents a serious risk, and attackers actively exploit them to steal data, compromise systems, and gain unauthorized access.

How We Help You Stay Secure

We provide comprehensive information about the OWASP Top 10 vulnerabilities, including:

✅ Description of each security risk.
✅ Examples of how attackers exploit them.
✅ Practical remediation strategies to fix and prevent vulnerabilities.

Our goal is to help developers, security engineers, and businesses strengthen their security posture by identifying and eliminating these threats before they can be exploited. Whether you’re looking for technical deep dives or straightforward mitigation steps, our resources give you everything you need to build and maintain secure applications.

Stay ahead of attackers—understand and defend against the OWASP Top 10 today!

In this section

Last updated

References