Back to blog
Application security

OWASP Top 10 – Most Critical Web Application Security Risks

Published: 2025-02-082 minKrzysztof Jaroński

What is the OWASP Top 10?

OWASP (Open Web Application Security Project) periodically publishes a list of the ten most common and serious web application security risks. It is not a list of "all" threats but a starting point for security review and planning tests (including pentests).

Why bother with the Top 10?

  • Common language – teams and auditors use these categories in reports.
  • Priorities – helps focus on what shows up most often in practice.
  • Compliance – many standards and client requirements refer to OWASP.

Selected categories (overview)

A01: Broken Access Control

Access control flaws – users can view or modify data they should not access (e.g. IDOR).

A02: Cryptographic Failures

Weak encryption, storing sensitive data in the clear, missing TLS where needed.

A03: Injection

Code injection (SQL, NoSQL, OS, LDAP) – user input treated as part of a query or command.

A04: Insecure Design

Weak architecture and design – no security by design, no threat modelling.

A05: Security Misconfiguration

Misconfigured servers, frameworks, headers (CORS, CSP), default passwords, unnecessary features enabled.

A06–A10

Other categories include vulnerable components (outdated libraries), auth failures, logging and monitoring, SSRF. Worth checking the full list on the OWASP site.

Next steps

Knowing the Top 10 helps in code review, in preparing for web application and API penetration testing and in discussions with the client about scope. If you build or maintain a web application, it is worth checking from time to time whether your solutions address these areas.

Planning a pentest? We can discuss scope with OWASP and your tech stack in mind.