Skip to main content

OWASP Top 10: 2021 vs 2025

Purpose: this document explains what changed between the 2021 and 2025 revisions of the OWASP Top 10, and why this repository uses 2021 as the practical baseline while acknowledging 2025 as the current production-oriented standard.

Official sources:

Why two versions​

OWASP Top 10 is not a fixed list of vulnerabilities. It is a risk-ranking of the most critical web application security risks, updated every few years based on data from thousands of applications and community surveys.

The 2021 revision focuses on specific vulnerability classes (Injection, SSRF, XXE) - the kind of issues that appear on OSCP, HTB, and in real penetration tests.

The 2025 revision shifts toward architecture and process risks (Supply Chain, Exceptional Conditions, Misconfiguration) - the kind of issues that cause breaches in production environments but are harder to demonstrate in a lab.

Both are correct. They answer different questions:

  • "What technique do I use to exploit this app?" -> 2021.
  • "What process failed that allowed this class of bug?" -> 2025.

Category mapping (2021 -> 2025)​

20212025Change
A01 Broken Access ControlA01 Broken Access ControlSSRF merged into A01
A02 Cryptographic FailuresA04 Cryptographic FailuresDropped 2 places
A03 InjectionA05 InjectionDropped 2 places
A04 Insecure DesignA06 Insecure DesignDropped 2 places
A05 Security MisconfigurationA02 Security MisconfigurationRose 3 places
A06 Vulnerable and Outdated ComponentsA03 Software Supply Chain FailuresExpanded and renamed
A07 Identification and Authentication FailuresA07 Identification and Authentication FailuresUnchanged
A08 Software and Data Integrity FailuresA08 Software and Data Integrity FailuresUnchanged
A09 Security Logging and Monitoring FailuresA09 Security Logging and Monitoring FailuresUnchanged
A10 Server-Side Request Forgery (SSRF)(merged into A01)Removed as a separate category
-A10 Mishandling of Exceptional ConditionsNew category

Key changes in detail​

SSRF merged into Broken Access Control​

In 2021, SSRF had its own category (A10). In 2025, it is treated as a form of Broken Access Control (A01). Rationale: SSRF is fundamentally about the server acting outside its intended permissions, which is the definition of broken access control.

Impact on this repo: SSRF.md stays where it is (under 08 Vulnerabilities/). It is now cross-referenced from both A01 and the (removed) A10 entry.

Supply Chain expanded (A06 -> A03)​

In 2021, A06 covered "Vulnerable and Outdated Components" - a narrow view focused on libraries and frameworks. In 2025, it became A03 "Software Supply Chain Failures", which covers:

  • dependencies (npm, pip, Maven, NuGet);
  • build systems (CI/CD pipelines, GitHub Actions);
  • distribution channels (registries, mirrors);
  • signed artifacts and provenance (SLSA, sigstore).

Impact on this repo: the CMS files (05 CMS/) still cover the "vulnerable component" angle. A dedicated supply chain file is planned under A06-Vulnerable-Components.md (2021 naming) with a note about the 2025 expansion.

Security Misconfiguration rose to A02​

In 2021, misconfiguration was A05. In 2025, it is A02 - the second most critical risk. This reflects the reality that misconfigurations (open S3 buckets, default credentials, verbose errors, missing security headers) cause more breaches than sophisticated exploits.

Impact on this repo: the 04 Servers/ files (Apache, Nginx, IIS, Tomcat, Jetty) already cover server-specific misconfigurations. A cross-server file is planned under A05-Security-Misconfiguration.md.

Injection dropped to A05​

Injection remains critical, but its relative ranking dropped from A03 to A05. This is not because injection is less dangerous - it is because other categories (misconfiguration, supply chain) have become more prevalent in real-world incidents.

Impact on this repo: 08 Vulnerabilities/ already has the strongest coverage of any category (SQLi, Command-Injection, SSTI, XXE, LFI-RFI, Deserialization). No changes needed.

New: Mishandling of Exceptional Conditions (A10)​

The 2025 revision introduces a new category focused on error handling: logic flaws triggered by unexpected input, "fail open" scenarios, resource exhaustion, and improper state transitions.

This category is close to what 2021 called "Insecure Design" (A04) but is more specific: it is about what happens when things go wrong, not about the design itself.

Impact on this repo: no existing file covers this. It is related to A04-Insecure-Design.md (planned) and would be a natural extension of it, or a separate file.

What this repo uses, and why​

Practical guides: 2021.

Reason: OSCP, HTB, and real penetration tests are about techniques. 2021 categorizes techniques in a way that maps cleanly to walkthroughs and exploits. The 2021 numbering is also what most training material, CVEs, and tools still reference.

Production context: 2025.

Reason: when writing about architecture, CI/CD, dependency management, or defensive controls, 2025 is the current standard. The coverage map in README.md uses 2021 for consistency, but every relevant file notes the 2025 equivalent.

Portfolio value: both.

Reason: an AppSec hiring manager expects awareness of the current standard. A pentest hiring manager expects practical technique coverage. This repo shows both by using 2021 as the practical base and documenting 2025 as the production reference.

What changed for practitioners​

If you only have time for one version:

  • Red team / pentest / OSCP: use 2021.
  • Blue team / AppSec / DevSecOps: use 2025.
  • Both: read this document, then use 2021 as your checklist and 2025 as your architecture review.

The technique-level content (SQLi, XSS, SSRF, deserialization) did not change between versions. What changed is how the industry groups and prioritizes the risks.

See also​