Every few years the security community publishes an updated “most wanted” list for web applications. The 2025 edition is out — here’s what changed and what it means for your product.
Who it’s for
Product owners and developers of web applications
You’ll learn
- · What the OWASP Top 10 is
- · What changed in 2025
- · How it guides testing
Reading time
7 min read
Why this matters to your business
The OWASP Top 10 is the list customers, auditors and investors refer to. Being able to say your app was tested against every item is a strong trust signal.
OWASP Top 10:2025
- A01Broken Access Control
- A02Security Misconfiguration
- A03Software Supply Chain Failures
- A04Cryptographic Failures
- A05Injection
- A06Insecure Design
- A07Authentication Failures
- A08Software or Data Integrity Failures
- A09Security Logging & Alerting Failures
- A10Mishandling of Exceptional Conditions
Access control stays on top
Broken access control remains the number-one risk. Problems where one user can see or change another user’s data continue to be the most common serious finding in web applications.
New emphasis on the supply chain
Software supply chain failures now have their own category, reflecting the risk from third-party components, build pipelines and dependencies.
Mishandling of exceptional conditions is also new — how applications behave when something unexpected happens.
What it means for testing
A good web application test should cover every category, with particular depth on access control and business logic. Our checklists map to every item on the list.
Why the list changes
The OWASP Top 10 is updated using data from real-world applications and community input. Categories rise or fall as development practices and attack patterns change — for example, the growing reliance on third-party code.
Using it in your team
Share the list with developers, product owners and QA. Use it as a checklist in design reviews and as a training topic. When a test report maps findings to the list, it becomes easy to spot recurring weak areas.
From our work · technical details
How we handle this in Web Application VAPT
- Insecure direct object references (IDOR)
- Stored and reflected cross-site scripting
- Broken access control between user roles
- SQL injection in search and filter parameters
- Weak password reset flows
- Missing security headers and insecure cookies
Jargon buster
- OWASP
- A respected non-profit that publishes free web security guidance.
- Access control
- The rules that decide who can see or change what.
- Supply chain
- The third-party code and services your software depends on.
How our team helps
- 01Map our web checklist to every OWASP category
- 02Test access control across all roles in depth
- 03Review components and dependencies in scope
- 04Report each category as passed or failed
- 05Tag every finding with its OWASP category
- 06Highlight recurring categories across tests
- 07Suggest training topics for your developers
Want to know how your app scores against the list? That’s exactly what a web application test tells you.
— The CRIS InfoTech security team