OWASP Top 10 Documentation

OWASP provides free and open resources for improving application security, including tools, standards, research, and libraries. You can access the following resources to support secure development and testing:

• Security Tools & Standards: Application security tools and industry standards.
• Research & Controls: Cutting edge research and standard security controls/libraries.
• Educational Materials: Books on testing, secure code development, and code review, as well as presentations and videos.
• Cheat Sheets: Practical guidance on common security topics via the OWASP Cheat Sheet Series.
• Community & Events: Local chapter meetings, training, and conferences.

For more information, visit the official website at https://owasp.org.

You are at high risk for A06:2021 (Vulnerable and Outdated Components) if any of the following conditions are met:

• You do not know the versions of all components used (including client-side, server-side, and nested dependencies).
• Software is vulnerable, unsupported, or out of date (OS, web/application servers, DBMS, APIs, runtime environments, or libraries).
• You do not perform regular vulnerability scans or subscribe to security bulletins.
• Patching/upgrading of platforms and frameworks is not performed in a timely, risk-based fashion (e.g., waiting months due to change control).
• Updated libraries are not tested for compatibility before deployment.
• Component configurations are not secured.

The OWASP Top 10 2017 ranking is determined by a combination of quantitative data and qualitative surveys. The methodology uses two primary inputs:

1. Industry Ranked Survey: A qualitative survey where community members ranked vulnerability categories. This survey helped identify emerging threats like 'Exposure of Private Information' and 'Insecure Deserialization'.
2. Public Data Call (Incidence Rate): A quantitative analysis of vulnerability prevalence. Instead of traditional frequency (counting every instance), the 2017 methodology calculates the incidence rate: the percentage of applications in a dataset that contain one or more instances of a specific vulnerability type. This allows for a more comparable analysis between tool-assisted and human-assisted findings.

An application or API is vulnerable to Insecure Deserialization if it deserializes hostile or tampered objects supplied by an attacker. This typically occurs when serialization is used for:

• Communication: Remote- and inter-process communication (RPC/IPC), wire protocols, web services, or message brokers.
• Persistence/Storage: Caching, databases, cache servers, file systems, or persistence layers.
• Client-side Data: HTTP cookies, HTML form parameters, or API authentication tokens.

The OWASP Top 10 uses a specific Risk Rating Methodology to order categories based on the significant risk they introduce to typical web applications. This methodology is used to estimate risk by combining likelihood factors and impact factors.

Note: This methodology provides generalities and does not account for specific threat agents, your application's unique technical details, or your specific business impact. Application owners must perform their own risk analysis based on their specific culture, industry, and regulatory environment.

The OWASP Top 10 repository maintains an archive of historical security risk rankings. You can access documentation and data for the following released versions:

• 2021
• 2017
• 2013
• 2010
• 2007
• 2004
• 2003

An application is vulnerable to injection when untrusted user input is sent to an interpreter (browser, database, command line) and executed as a command. Common patterns include:

• User-supplied data is not validated, filtered, or sanitized.
• Dynamic queries or non-parameterized calls are used without context-aware escaping.
• Unsanitized data is used within ORM search parameters to extract sensitive records.
• Hostile data is directly concatenated into the structure of a SQL or command string.

Common types include SQL, NoSQL, OS command, ORM, LDAP, and Expression Language (EL) or OGNL injection.

The OWASP Top 10:2025 categories are selected using a hybrid approach combining automated data analysis and community expertise:

1. Data-Driven Selection (8 Categories): Eight categories are derived from CVE (Common Vulnerabilities and Exposures) data extracted via OWASP Dependency Check. The methodology calculates average Exploitability and (Technical) Impact scores by grouping CVEs by their associated CWEs (Common Weakness Enumerations). The scoring weights CVSSv3 scores more heavily than CVSSv2 scores to account for differences in scoring formulas.

2. Community Survey (2 Categories): Because automated data often lags behind emerging trends and relies on existing testing methodologies, two categories are selected via a community survey. This allows AppSec practitioners to vote on high-risk trends that may not yet be fully captured in automated vulnerability datasets.

The OWASP Top 10 repository provides access to different versions of the Top 10 web application security risks documentation. Use the following links to access the current and historical versions:

• Current Version (2025): OWASP Top10:2025
• Superseded Version (2021): OWASP Top10:2021
• Historic Version (2017): Available in PPTX and PDF formats.

An application may be vulnerable to XXE if it meets any of the following criteria:

• The application accepts XML directly, accepts XML uploads from untrusted sources, or inserts untrusted data into XML documents parsed by an XML processor.
• Any XML processors or SOAP-based web services have Document Type Definitions (DTDs) enabled.
• The application uses SAML for identity processing (federated security or SSO), as SAML uses XML for identity assertions.
• The application uses SOAP versions prior to 1.2, which may pass XML entities to the SOAP framework.
• The application is susceptible to denial-of-service attacks like the 'Billion Laughs' attack via XML processing.