The OWASP Top 10 is an awareness document for web application security, published by the Open Worldwide Application Security Project (OWASP). It represents a broad consensus among security experts about the most critical security risks to web applications.

Adopting the OWASP Top 10 is an effective first step towards a development culture that produces more secure code. The list is updated every few years. The current edition is from 2021; the 2017 edition is still widely referenced.

The OWASP Top 10 (2021)

A01 Broken Access Control

Access control decides which users may reach which content and functions. When it is broken, users can act outside their intended permissions, for example by viewing another customer's records or reaching admin functions.

A02 Cryptographic Failures

Previously called Sensitive Data Exposure. Sensitive data, such as passwords, payment details and personal information, is exposed because it is not encrypted in transit or at rest, or because weak algorithms are used.

A03 Injection

Untrusted input is sent to an interpreter as part of a command or query. SQL injection, command injection and, since 2021, cross-site scripting (XSS) belong here.

A04 Insecure Design

Flaws in the design of the application itself, such as missing limits on sensitive business flows. No amount of careful coding fixes a design that lacks the needed security controls.

A05 Security Misconfiguration

Insecure default settings, unnecessary features, verbose error messages, default passwords and missing security headers. XML External Entities (XXE) is now part of this category.

A06 Vulnerable and Outdated Components

Libraries, frameworks and other components with known vulnerabilities. Because applications are built largely from third-party code, one outdated component can expose the whole system.

A07 Identification and Authentication Failures

Previously Broken Authentication. Weak passwords, missing brute-force protection and poor session handling let attackers take over accounts.

A08 Software and Data Integrity Failures

Code and data that are trusted without verifying their integrity, including insecure deserialization and updates or scripts loaded from untrusted sources.

A09 Security Logging and Monitoring Failures

Without sufficient logging and monitoring, attacks go unnoticed and incidents are hard to investigate.

A10 Server-Side Request Forgery (SSRF)

The server fetches a URL supplied by the user without validating it, letting attackers reach internal systems.

How to use the list

• Use it as a baseline for developer training and code review.
• Test your applications against each category, and repeat the tests regularly.
• Treat it as a starting point: the Top 10 is a minimum, not a complete standard.

How Vooki Pro helps

• Maps every finding to its OWASP Top 10 2021 category.
• Produces an OWASP Top 10 compliance report, plus reports for PCI DSS v4.0, NIST 800-53, ISO 27001, HIPAA, GDPR and SOC 2.
• Covers injection, broken access control, authentication failures, cryptographic failures, misconfiguration, outdated components and SSRF with more than 300 checks.
• Shows evidence and remediation for each finding, so teams can work through the list.

Frequently asked questions

What is the OWASP Top 10?

A regularly updated list of the ten most critical web application security risks, published by the Open Worldwide Application Security Project (OWASP).

Which OWASP Top 10 version is current?

The 2021 edition is the current web application list. OWASP also publishes a separate API Security Top 10.

Related: The OWASP API Security Top 10, explained · Cross-Site Scripting (XSS): reflected, stored and DOM-based