OneTaskBy Tim King · Updated
OWASP Top 10
Plain Explanations, Prevention Steps and 2021 Position for Each Risk
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the OWASP Top 10 Reference works
The OWASP Top 10 is the best-known list of the most serious risks to web applications. Choose the 2025 or 2021 edition to see every category with a plain explanation, the main ways to prevent it and where it ranked in the edition before. Search to find a category by keyword.
What the OWASP Top 10 is and how it changed
The Open Worldwide Application Security Project publishes the list every few years from data on real vulnerabilities, plus a survey of practitioners for risks the data under-counts. It is an awareness document, not a complete standard, but it is widely used in training, audits and contracts as a common language for web security.
The 2025 edition keeps Broken Access Control at number one and folds Server-Side Request Forgery into it. Security Misconfiguration moves up to second. Vulnerable and Outdated Components widens into Software Supply Chain Failures, covering compromised packages and build pipelines as well as unpatched libraries. Mishandling of Exceptional Conditions is new at number ten, covering systems that fail open or leak details when something goes wrong.
The 2021 edition is included because many policies and tools still refer to its numbering. The last column shows where each category came from, so you can map findings between editions.
Is there an OWASP Top 10 formula?
There is no fixed formula. OWASP ranks each category from contributed test data, mainly the incidence rate (the share of tested applications with at least one weakness mapped to the category), weighted by exploit and impact scores from CVSS data. Two places in each edition come from a community survey, so newer risks that testing does not yet find well still make the list.
Worked example: the 2025 changes
Broken Access Control stays at A01. Security Misconfiguration climbs from A05 to A02. Vulnerable and Outdated Components is widened into Software Supply Chain Failures at A03, and Mishandling of Exceptional Conditions is new at A10. Server-Side Request Forgery is folded into Broken Access Control.
Worked example: mapping a finding
A SQL injection bug found in testing maps to A05 Injection in 2025 and A03 Injection in 2021. An S3 bucket left public maps to Security Misconfiguration, A02 in 2025 and A05 in 2021.
OWASP Top 10 reference table
The ten categories in the 2025 and 2021 editions.
| Edition | Rank | Category |
|---|---|---|
| 2025 | A01 | Broken Access Control |
| 2025 | A02 | Security Misconfiguration |
| 2025 | A03 | Software Supply Chain Failures |
| 2025 | A04 | Cryptographic Failures |
| 2025 | A05 | Injection |
| 2025 | A06 | Insecure Design |
| 2025 | A07 | Authentication Failures |
| 2025 | A08 | Software and Data Integrity Failures |
| 2025 | A09 | Security Logging and Alerting Failures |
| 2025 | A10 | Mishandling of Exceptional Conditions |
| 2021 | A01 | Broken Access Control |
| 2021 | A02 | Cryptographic Failures |
| 2021 | A03 | Injection |
| 2021 | A04 | Insecure Design |
| 2021 | A05 | Security Misconfiguration |
| 2021 | A06 | Vulnerable and Outdated Components |
| 2021 | A07 | Identification and Authentication Failures |
| 2021 | A08 | Software and Data Integrity Failures |
| 2021 | A09 | Security Logging and Monitoring Failures |
| 2021 | A10 | Server-Side Request Forgery (SSRF) |
Quick answers
- Broken Access Control has been number one since 2021.
- Injection fell from A03 in 2021 to A05 in 2025.
- Cross-site scripting counts as Injection.
- There are still ten categories in each edition, and you can check how many of them your own testing covers.
- OWASP updates the list roughly every four years.
FAQ
Is the OWASP Top 10 a security standard?
Not strictly. It is an awareness list of the most common and serious risks. For a full checklist of requirements to test against, OWASP points people to the Application Security Verification Standard.
Why did SSRF disappear in 2025?
It was merged into Broken Access Control, since making a server fetch an internal address is a failure to enforce what the attacker may reach. The prevention advice, allow-listing destinations, is unchanged.
Which edition should I use?
Use 2025 for new training and reviews. Keep 2021 where a contract, audit or tool still names its category numbers, and use the previous-edition column to translate findings from one to the other.
Does fixing the Top 10 make an app secure?
It covers the most common problems, not all of them. Business logic flaws, abuse of features and risks specific to your industry can fall outside it, so threat modelling your own app is still needed.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
CVSS Calculator
Score a vulnerability with CVSS 3.1 from metrics or a vector.
Security Headers Checker
Check pasted response headers for missing, weak and leaky security headers.
CSP Tester
Explain a CSP, flag weaknesses, and test whether a URL would load.
Password Policy Generator
Write a modern NIST-based password policy for your organisation.
CVE ID Validator
Check a list of CVE IDs for format errors and duplicates.