OWASP Top 10: the most common web app flaws

The OWASP Top 10 is the most recognisable ranking of web application risks — a considered list of what most often goes wrong. It isn’t a checklist to “tick off”, but a map of the areas that return the most findings in penetration tests. Here are the most important ones, without the jargon.

Broken access control — number one

At the head of the current list sits Broken Access Control. That’s no accident — the most common real problem isn’t an exotic exploit, but the absence of a check on whether a given user is allowed to do what they’re asking. Accessing someone else’s data by changing an identifier, calling an admin function by hand, bypassing client-side restrictions — these are everyday findings.

The defensive rule: authorise server-side, for every operation, deny by default.

Injection and cryptographic failures

Injection (SQL, commands, LDAP…) — user data reaches an interpreter as part of a command. The defence is parameterised queries and treating every input as untrusted.
Cryptographic Failures — sensitive data without encryption, weak algorithms, passwords without proper hashing. Encrypt in transit and at rest, use proven libraries.

XSS, SSRF and misconfiguration

Cross-Site Scripting (XSS) — an injected script runs in the victim’s browser. Contextual output encoding and a CSP policy defend against it.
SSRF — the app fetches a URL supplied by the user and queries internal resources (e.g. cloud metadata). Restrict where the server is allowed to connect.
Security Misconfiguration — default passwords, unnecessary services, verbose errors. It’s the same discipline we write about in our piece on cloud security.

How to use it in practice

The OWASP Top 10 works best not as a checklist, but as a common language between developers and security, and as a starting point for threat modelling. Woven into the development cycle (code review, testing, CI/CD gates) it lowers the cost of fixing — because the cheapest time to remove a flaw is before it reaches production. If you’d like to test your application against these risks, book a penetration test.

The OWASP Top 10 is not a complete test standard

The 2021 OWASP Top 10 is an awareness document describing broad risk classes. It does not mean an application is secure after ten checks. One category such as Broken Access Control contains many distinct failures: IDOR, missing administrative-function checks, token manipulation, cross-tenant access and CORS mistakes.

Use OWASP ASVS to define requirements and Top 10 to structure product conversations. Testing must follow architecture, data flows, roles and business functions rather than category labels alone.

From requirement to evidence

Identify assets and trust boundaries first. For each function, define who may call it, against which object and in which state. Build positive and negative cases: another role, another owner, a missing parameter, changed type, replayed request and unexpected sequence.

A scanner result is a hypothesis. It becomes a finding only after manual validation with impact evidence and a remediation condition. Reports should identify the root cause, not merely a payload, so the team can remove the vulnerability class rather than patch one endpoint.

A minimum AppSec programme

threat modelling before high-risk feature implementation;
code review for authorisation, cryptography and parser boundaries;
unit and integration tests for negative access cases;
SAST, SCA and secret scanning as supporting signals, not sole verdicts;
DAST and manual testing in a production-representative environment;
retesting after remediation and regression coverage in CI.

Connect this programme with OWASP ASVS and API security, because a modern web application rarely ends at the HTML interface.

Sources: OWASP Top 10:2021, OWASP Application Security Verification Standard.