OWASP Top 10 — 2025

Users can act outside their intended permissions. This includes accessing other users' data, modifying access rights, or bypassing access controls by tampering with URLs, API requests, or internal state.

Sensitive data is exposed due to weak or missing encryption. This includes transmitting data in cleartext, using deprecated algorithms, or improperly managing cryptographic keys.

User-supplied data is sent to an interpreter as part of a command or query without validation or sanitization. This includes SQL injection, NoSQL injection, OS command injection, and XSS.

Security flaws baked into the design itself — not implementation bugs, but missing or ineffective security controls that should have been designed in from the start.

Insecure default configurations, incomplete setups, open cloud storage, misconfigured HTTP headers, or verbose error messages exposing sensitive information.

Using libraries, frameworks, or dependencies with known vulnerabilities. This includes not patching, not tracking dependency versions, or using unmaintained packages.

Weaknesses in authentication mechanisms that allow attackers to compromise passwords, keys, or session tokens, or to exploit flaws to assume other users' identities.

Code and infrastructure that doesn't protect against integrity violations. This includes using untrusted plugins, libraries, or CDNs without verification, and insecure CI/CD pipelines.

Insufficient logging, monitoring, and alerting that prevents detection of active attacks, breaches, or suspicious activity.

The application fetches a remote resource based on a user-supplied URL without validating the destination. Attackers can coerce the server to make requests to internal services.