Common Web Vulnerabilities (OWASP Top 10)

The most common web application security risks, and the concrete pattern behind each one.

What it is

The OWASP Top 10 is the industry-standard list of the most critical web application security risks, updated periodically from real-world vulnerability data.

Key points

Injection (SQL, command, etc.): untrusted input executed as code — prevented with parameterized queries, never string-concatenated SQL.
Broken access control: the top-ranked risk — endpoints or objects reachable without proper authorization checks (e.g. changing an ID in a URL to access another user's data).
Cross-Site Scripting (XSS): untrusted input rendered as HTML/JS in another user's browser — prevented by output encoding and Content Security Policy.
Cryptographic failures: sensitive data transmitted or stored without proper encryption, or with weak/outdated algorithms.
The common thread across most entries: untrusted input handled without validation, encoding, or an authorization check at the point it's used.