Web security
OWASP Top 10:2025 vs 2021: What Changed and Which Category Is Which
The OWASP Top 10 is the most quoted list in web security, and it was updated for 2025. Exams, interviews and reports still use both the 2021 and the 2025 numbering, so students keep asking which category is which. This guide puts the two lists side by side, from OWASP's own pages checked on 13 Nov 2026, and answers the questions that come up most.
The OWASP Top 10:2025 List
- A01:2025 Broken Access Control
- A02:2025 Security Misconfiguration
- A03:2025 Software Supply Chain Failures
- A04:2025 Cryptographic Failures
- A05:2025 Injection
- A06:2025 Insecure Design
- A07:2025 Authentication Failures
- A08:2025 Software or Data Integrity Failures
- A09:2025 Security Logging and Alerting Failures
- A10:2025 Mishandling of Exceptional Conditions
The OWASP Top 10:2021 List, for Comparison
- A01:2021 Broken Access Control
- A02:2021 Cryptographic Failures
- A03:2021 Injection
- A04:2021 Insecure Design
- A05:2021 Security Misconfiguration
- A06:2021 Vulnerable and Outdated Components
- A07:2021 Identification and Authentication Failures
- A08:2021 Software and Data Integrity Failures
- A09:2021 Security Logging and Monitoring Failures
- A10:2021 Server-Side Request Forgery (SSRF)
What Changed, in Plain Words
- Broken Access Control stays at number one, and SSRF is now folded into it, so SSRF is no longer its own entry.
- Security Misconfiguration moves up from fifth to second place.
- Software Supply Chain Failures replaces Vulnerable and Outdated Components with a wider scope: dependencies, build systems and distribution, not only old libraries.
- Injection and Cryptographic Failures each drop two places. Injection is now fifth.
- Two names change: Authentication Failures (shorter) and Security Logging and Alerting Failures (alerting, not only monitoring).
- One category is new: Mishandling of Exceptional Conditions, covering poor error handling and systems that fail open.
Quick Answers Students Ask For
- Which category includes SQL injection? Injection: A05:2025, and A03:2021.
- Which category includes cross-site scripting? The same one, Injection. OWASP's 2025 text says it ranges from cross-site scripting (frequent, lower impact) to SQL injection (rarer, higher impact).
- Which category includes SSRF? A01:2025 Broken Access Control. In 2021 it was A10.
- An app allows unlimited password attempts. Which category? Authentication Failures: A07:2025, and A07:2021 under its older name. Missing attempt limits make brute force possible.
- Which category covers an old library with a known flaw? Software Supply Chain Failures in 2025, Vulnerable and Outdated Components in 2021.
- Which category covers a user reading another user's record by changing an ID? Broken Access Control. See IDOR explained.
- Which category covers missing logs and alerts? Security Logging and Alerting Failures: A09 in both lists.
In an exam, check which year the question uses. The category name may be the same while the number is not.
Why Testers Still Care About the List
The Top 10 is an awareness list, not a complete test plan. A real web test follows the OWASP Web Security Testing Guide and looks well beyond ten items. But the numbering appears in reports and tools, so you should know it. For a plain-language walk through each risk, read OWASP Top 10 explained for beginners, and for APIs the OWASP API Security Top 10. The newest OWASP list for AI features is covered in AI penetration testing: what to learn.
Where It Fits in Our Courses
The web modules of our Application Security course are organised around these risks, with a lab for each, and the graded reports map every finding to the category it breaks. The course is ₹20,000 + GST, and it is the first half of the VAPT Track.
Sources and Further Reading
Want to practise each risk in a lab instead of memorising the list? Try 3 to 5 classes free. Contact us or call +91 86868 92922.
Where This Guide Fits in Our Training
- Web Application Penetration Testing Course in Hyderabad: the web application testing course and how it is taught
- API Security Training Online: REST, SOAP and GraphQL testing, with Burp Suite
- Cyber Security Course with Practical Labs in Hyderabad: how the labs work and what you practise in each class
Courses Mentioned in This Guide
More Guides
OWASP API Security Top 10 Explained for Beginners
The OWASP API Security Top 10 (2023) in plain language: BOLA, broken authentication, property and function-level authorization, SSRF and more.
Read the guide →Bug Bounty for Beginners in India: How to Start Safely
How bug bounty programs work, the skills you need first, how to read scope and rules, write a good report, and avoid legal trouble as a beginner in India.
Read the guide →Prompt Injection Explained: The Top Risk in AI Applications
What prompt injection is, direct and indirect examples, why it is hard to fix, how testers check for it, and the OWASP Top 10 for LLM Applications 2025.
Read the guide →Burp Suite for Beginners: Proxy, Repeater and Intruder Explained
Get started with Burp Suite: Community vs Professional, setting up the proxy, and using Proxy, Repeater, Intruder and Decoder to test web applications legally.
Read the guide →Start Your Cyber Security Career
Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.
- Call+91 86868 92922
Open 7 days: Mon to Fri 8:30 AM to 8:30 PM IST
Sat and Sun 10 AM to 6 PM IST - Emailinfo@hackingtrainer.com
- VisitGround Floor, G-3, Sri Venkatasai Nest, Kallu Compound Road, Nagarjuna Nagar Colony, Yella Reddy Guda, Ameerpet, Hyderabad – 500073
Open in Google Maps