OWASP Top 10

Restrictions on what authenticated users can do are not properly enforced. Attackers exploit these flaws to access unauthorised functionality and data: viewing other users' accounts, modifying records, changing access rights.

Failures related to cryptography (or lack of it) leading to exposure of sensitive data: passwords, payment data, health records, PII. Often surfaces as data sent in clear text or stored with weak/legacy algorithms.

User-supplied data is not validated, filtered, or sanitised by the application, and reaches an interpreter (SQL, NoSQL, OS command, LDAP, XPath) where it executes unintended commands.

Architectural flaws — missing or ineffective control design — that no amount of perfect implementation can fix. Distinct from implementation bugs. Threat-modelling and secure-by-design patterns are the antidote.

Insecure defaults, incomplete configuration, open cloud storage, verbose error messages with stack traces, unnecessary features enabled, default accounts left in place. Often the easiest path in.

Using libraries, frameworks, OS, runtimes with known CVEs. Modern apps pull hundreds of transitive dependencies; one weak link often leads to RCE or data exposure.

Confirmation of user identity, authentication, and session management is implemented incorrectly: credential stuffing, weak/known passwords accepted, missing MFA, weak session-token generation.

Code and infrastructure that don't protect against integrity violations: insecure CI/CD pipelines, auto-update without signature verification, untrusted plugin/library sources.

Insufficient logging, monitoring, alerting. Without it, breaches remain undetected. The Verizon DBIR routinely measures breach-detection times in months — most by external parties, not the victim.

The web app fetches a remote resource without validating the user-supplied URL. An attacker coerces the server into making requests to unintended destinations: internal services, cloud metadata endpoints, file:// URLs.