What is the OWASP Top 10?

The OWASP Top 10 is a standard awareness document for developers and web application security, published by the Open Worldwide Application Security Project (OWASP), a nonprofit foundation dedicated to improving the security of software.

It represents a broad consensus about the most critical security risks to web applications. Each edition is built from vulnerability data contributed by organizations and security vendors, combined with a community survey that captures emerging risks the data can't show yet. The list is updated every few years, and the current edition is 2025.

The OWASP Top 10 is broken into the following components:

Risk Categories

Each of the ten entries is a category of related weaknesses rather than a single bug. Every category has an ID made up of its rank and the edition year, so A05:2025 is the fifth-ranked risk in the 2025 edition. Tags on this site use that same ID.

The 2025 categories are listed below:

• A01:2025 Broken Access Control - Users are able to act outside of their intended permissions, such as viewing other users' data, changing records they shouldn't, or reaching admin functions. Server-side request forgery (SSRF) is now included in this category.
• A02:2025 Security Misconfiguration - Insecure default settings, unnecessary features or services, overly detailed error messages, or missing hardening anywhere in the application stack.
• A03:2025 Software Supply Chain Failures - Weaknesses or compromises in the dependencies, build systems, and distribution infrastructure that software relies on. This expands the older "Vulnerable and Outdated Components" category.
• A04:2025 Cryptographic Failures - Missing, weak, or misused cryptography that exposes sensitive data in transit or at rest.
• A05:2025 Injection - Untrusted input is sent to an interpreter and executed as part of a command or query, including SQL injection, command injection, and cross-site scripting (XSS).
• A06:2025 Insecure Design - Flaws in an application's architecture and design, where security controls are missing or ineffective from the start and can't be fixed by a perfect implementation alone.
• A07:2025 Authentication Failures - Weaknesses in how an application confirms who a user is and manages their session, allowing attacks such as credential stuffing, brute force, or session hijacking.
• A08:2025 Software or Data Integrity Failures - Code, updates, or data are trusted without verifying their integrity, such as unsigned updates or insecure deserialization.
• A09:2025 Security Logging and Alerting Failures - Missing or insufficient logging, monitoring, and alerting, which keeps attacks from being detected and responded to in time.
• A10:2025 Mishandling of Exceptional Conditions - Errors and unusual conditions aren't handled safely, causing applications to fail open, crash, or leak sensitive information.

How These Tags Are Used

OWASP tags are only applied to web-focused content, such as web application testing labs, web proxy tools like Burp Suite and Caido, and web-related CTFs. Because the edition year is part of each ID, these tags will never be confused with older editions of the list, like the 2021 Top 10.