How to use the OWASP Top 10 Cheat Sheet
- 1. Browse or searchScroll the list or search for a word like XSS or SSRF.
- 2. Read the fixEach card has a short example and prevention steps.
- 3. DownloadSave the sheet as a text file for revision or a team wiki.
What changed in the 2025 list
The OWASP Top 10 is the best-known awareness list of web application security risks. The 2025 edition replaces the 2021 list. Broken Access Control stays at number one and now includes server-side request forgery (SSRF), which had its own slot in 2021. Security Misconfiguration rises to number two.
Two categories are new: A03:2025 Software Supply Chain Failures, which widens the old "vulnerable and outdated components" to cover compromised packages and build pipelines, and A10:2025 Mishandling of Exceptional Conditions, about errors that fail open or leak details. Cryptographic Failures, Injection and Insecure Design each move down two places.
How to use the list
- Developers: use it as a checklist during design and code review.
- Testers: plan security test cases around each category.
- Students: it is a common interview topic; be ready with one example and one fix per item.
- Teams: pair it with the OWASP ASVS for detailed, testable requirements.
The Top 10 is an awareness document, not a full standard; passing it does not make an app secure. Category names and order here follow the OWASP Top 10:2025 published by the OWASP Foundation; check owasp.org for the official text and any later updates. Examples are simplified for learning. Put the injection and XSS lessons into practice with the CSP generator, and test yourself with the cyber security quiz.
Frequently asked questions
Is XSS still in the Top 10?
Yes. Cross-site scripting is part of A05:2025 Injection.
Where did SSRF go?
In 2025 it is covered under A01 Broken Access Control instead of being a separate category.
Is the OWASP Top 10 Cheat Sheet free?
Yes, the OWASP Top 10 Cheat Sheet is free. The first time you download the sheet, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.