OWASP Top 10 (2021/2025) explained with real examples

Quick answer: The OWASP Top 10 is the reference list of the 10 most critical web security risk categories, maintained by the OWASP foundation. The current official version is the 2021 one (with a 2025 release candidate in progress). It's not a list of isolated vulnerabilities, but of risk families that every hunter and developer should master.

What is the OWASP Top 10?

The OWASP Top 10 is an awareness document published by the Open Worldwide Application Security Project (OWASP) every few years. Based on real data from thousands of applications, it summarizes the ten most serious and frequent risk categories in web security.

It matters for two reasons:

• For developers, it's the minimum checklist of what not to do.
• For bug hunters, it's the map of where the most repeated flaws are (and, chained, the ones that pay most).

The stable version cited in most programs is the 2021 one. OWASP published a release candidate of the next edition in 2025; the final structure may change, so here I explain the 2021 list (the official one) and note at the end where 2025 is heading.

A01 · Broken Access Control

It moved to number 1 in 2021: it was the category with the highest incidence of all. It happens when a user can do or see things they shouldn't: read another account's data, access admin functions or bypass restrictions.

Real example: you change /api/orders/123 to /api/orders/124 and see another customer's order (and address). That's an IDOR, the most common case of this family.

Dig deeper in Broken Access Control and IDOR; the practical theory is in Academy · IDOR & Broken Access Control.

A02 · Cryptographic Failures

Formerly called "Sensitive Data Exposure". It covers poorly protected sensitive data: traffic without TLS, passwords with weak hashes (MD5/SHA1 without salt), keys in the code, badly implemented encryption.

Real example: an API that returns full card numbers in the JSON response, or a login that travels over plain HTTP on a public network. The attacker doesn't "break" the crypto: they take advantage of the fact that there's almost none.

A03 · Injection

One of the oldest and most dangerous families. It happens when user data gets mixed into a command or query without being properly separated. In 2021, XSS became part of this category.

It includes several flaws that have their own page:

• SQL Injection — injecting SQL to read/modify the database.
• XSS — injecting JavaScript into the victim's browser.
• Command Injection — executing system commands.
• NoSQL Injection and SSTI.

Real example: a search box that builds the query with "SELECT * FROM users WHERE name = '" + input + "'" allows ' OR '1'='1 to dump the whole table. Practice the pattern in Academy · XSS and Academy · SQLi.

A04 · Insecure Design

New in 2021. It's not an implementation bug, but a design flaw: nobody thought about abuse from the start. It's not fixed with a single patch; the flow has to be redesigned.

Real example: a transfer process that checks the balance and deducts it in two non-atomic steps lets you spend the money twice by sending requests in parallel. That falls under Race Condition and business logic, which is among the best-paying because scanners don't detect it.

A05 · Security Misconfiguration

Servers, frameworks or services with insecure default settings: exposed admin panels, verbose error messages, misconfigured CORS, public S3 buckets, listable directories.

Real example: a /.git/ accessible from the browser lets you download the application's entire source code. Or a CORS with a reflected Access-Control-Allow-Origin that allows reading cross-origin data: it's explained in CORS and XXE.

A06 · Vulnerable and Outdated Components

Using libraries, frameworks or dependencies with known vulnerabilities. You don't have to discover the flaw: it already has a CVE; you just have to find where it's still unpatched.

Real example: Log4Shell (CVE-2021-44228), the vulnerability in the Log4j library that in 2021 allowed RCE across half the internet by just sending a string in a text field. Millions of systems affected by an outdated dependency.

A07 · Identification and Authentication Failures

Formerly "Broken Authentication". It covers weak logins: allowing brute force, broken session management, bypassable 2FA, insecure password recovery, poorly validated JWT tokens.

Real example: an OTP verification endpoint with no attempt limit lets you try all 1,000,000 six-digit codes. Or a JWT signed with alg: none that the server accepts. You have the deep dive in Auth Bypass, Academy · Authentication Bypass and Academy · OAuth.

A08 · Software and Data Integrity Failures

New in 2021. Trusting code, updates or data without verifying their integrity. It includes insecure deserialization and supply chain attacks.

Real example: the SolarWinds attack (2020), where malicious code was inserted into a legitimate software update that was later distributed to thousands of organizations. Blind trust in the source was the flaw.

A09 · Security Logging and Monitoring Failures

Not logging security events, or not alerting on them, lets attacks go unnoticed for months. It's rarely a direct bounty, but it amplifies the impact of all the others.

Real example: a company that takes 200 days to notice a breach because nobody was watching the massive failed logins or the anomalous data access.

A10 · Server-Side Request Forgery (SSRF)

Added in 2021 by community vote. The attacker gets the server to make requests to destinations of the attacker's choosing: the internal network, non-exposed services or the cloud metadata.

Real example: the Capital One breach (2019). An SSRF allowed reaching the AWS metadata endpoint (169.254.169.254), stealing IAM credentials and accessing the data of more than 100 million customers. It's the textbook example of why SSRF is in the Top 10: dig deeper in SSRF and Academy · SSRF.

Summary: the OWASP Top 10 2021 at a glance

And the OWASP Top 10 2025?

OWASP published a release candidate of the next edition in 2025. Like any revision, it's based on more recent data and a community survey, and the final list may differ from the draft. The general direction points to giving more weight to the software supply chain (the risk that A08 already started to capture in 2021) and to reorganizing some injection and configuration categories.

Practical tip: don't memorize the exact number of each category. What really matters is understanding the flaw families and being able to recognize them in a real application. When the final 2025 version comes out, the concepts will be the same; only the order and labels will change.

Frequently asked questions (FAQ)

Is the OWASP Top 10 a list of vulnerabilities?
Not exactly. They're risk categories. Within "Injection" fit SQLi, XSS, command injection, etc. It's a map of families, not a catalog of CVEs.

Do I have to memorize all 10 to do bug bounty?
Not by heart, but you do need to understand them. They give you a common vocabulary with security teams and orient you on where to look first.

Which category pays most?
The ones that touch money, data or code execution: Broken Access Control (A01), Injection (A03) and SSRF (A10) account for many of the best-paid reports.

Where do I practice all this?
In the BBLABS labs you reproduce real flaws from each family, in order with the roadmap. The category-by-category theory is in the vulnerability dictionary.

Conclusion

The OWASP Top 10 is the best starting point for ordering your thoughts: instead of a thousand isolated flaws, ten families that cover the vast majority of what you'll encounter. Master access control, injection and SSRF above all (they're the most frequent and the best paid), lean on the theory in the vulnerability dictionary and turn it into a reflex by practicing labs based on real cases.