The OWASP Top 10 is an awareness document covering the most critical categories of web application risk. The 2025 version updates the list, so older lists with SQL Injection in first place no longer reflect the current OWASP structure.

OWASP Top 10:2025

  1. Broken Access Control. A user gains access to actions or data they are not authorized to use.
  2. Security Misconfiguration. Unsafe settings, unnecessary services, default credentials, or incorrect security headers.
  3. Software Supply Chain Failures. Risks involving dependencies, the build process, and third-party components.
  4. Cryptographic Failures. Incorrect protection of sensitive data and keys.
  5. Injection. Untrusted data changes the logic of a query or command; this includes SQL injection.
  6. Insecure Design. Risks introduced at the requirements and architecture level.
  7. Authentication Failures. Errors in login, sessions, and credential management.
  8. Software or Data Integrity Failures. Insufficient verification of the integrity of code, updates, or data.
  9. Security Logging and Alerting Failures. An attack occurs, but the system does not provide the team with a sufficient signal.
  10. Mishandling of Exceptional Conditions. Incorrect handling of unexpected states can lead to unsafe behavior.

What to Do in Practice

Security cannot be reduced to a single scanner. Include threat modeling for critical scenarios, code review, dependency scanning, the principle of least privilege, centralized logging, and regular access-control testing.

For input data, use parameterized queries, contextual escaping, and trusted libraries. For authentication, use secure session management, MFA where justified, and protection against brute-force attacks.

Source: OWASP Top 10:2025.