Skip to content

Language / भाषाEnglish is the default.

Application security / OWASP

OWASP Top 10 2025

A clear starting point for the ten application-security risk categories. Learn what each means, see an example and understand how defenders respond.

Start with the overview Follow the guided path

An awareness framework, not a complete security checklist or certification. Official OWASP source

The ten categories, in order

Each lesson offers Simple, Technical and Practitioner explanations, a worked example and a knowledge check.

A01 · Broken Access ControlCompare an allowed request, an ownership failure and a server-enforced denial in the same application.6 minLesson

A02 · Security MisconfigurationUnderstand security misconfiguration through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A03 · Software Supply Chain FailuresUnderstand software supply chain failures through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A04 · Cryptographic FailuresUnderstand cryptographic failures through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A05 · InjectionUnderstand injection through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A06 · Insecure DesignUnderstand insecure design through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A07 · Authentication FailuresUnderstand authentication failures through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A08 · Software or Data Integrity FailuresUnderstand software or data integrity failures through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A09 · Security Logging and Alerting FailuresUnderstand security logging and alerting failures through a fictional failure, a defensive boundary and practical review questions.6 minLesson

A10 · Mishandling of Exceptional ConditionsUnderstand mishandling of exceptional conditions through a fictional failure, a defensive boundary and practical review questions.6 minLesson

Go deeper into a specific vulnerability

These lessons explain individual vulnerabilities. They are not additional entries in the Top 10.

SQL Injection

SQL injection is a specific form of injection.

Cross-Site Scripting

Cross-site scripting concerns untrusted content interpreted in the browser.

Related vulnerability

Server-Side Request Forgery

Server-side request forgery is a useful deep dive, not a separately named 2025 category.

Back to Application Security