---
title: OWASP Web Top 10 Vulnerability Index
description: Index of OWASP Web Application Security Top 10 vulnerability identifiers, categories, and cross-references
---

# 00 Vulnerability Index

This document provides the index for the OWASP Web Application Security Top 10 vulnerabilities.
Each entry includes its identifier, title, and primary category.

## Vulnerability catalog

| ID       | Title                                  | Category                 |
|----------|----------------------------------------|--------------------------|
| A01:2025 | Broken Access Control                  | Access Control           |
| A02:2025 | Security Misconfiguration              | Configuration Management |
| A03:2025 | Software Supply Chain Failures         | Supply Chain             |
| A04:2025 | Cryptographic Failures                 | Cryptography             |
| A05:2025 | Injection                              | Input Validation         |
| A06:2025 | Insecure Design                        | Architecture and Design  |
| A07:2025 | Authentication Failures                | Authentication           |
| A08:2025 | Software or Data Integrity Failures    | Data Integrity           |
| A09:2025 | Security Logging and Alerting Failures | Logging and Monitoring   |
| A10:2025 | Mishandling of Exceptional Conditions  | Error Handling           |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in web applications.
2. Risk — concrete consequences of exploitation and business impact.
3. Vulnerability checklist — indicators that the application is exposed.
4. Prevention controls — defensive measures and rectification steps.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and methods to identify exposure.
7. Remediation — immediate and long-term actions to contain and resolve.

## Category groupings

### Access Control

* A01:2025 Broken Access Control

### Configuration Management

* A02:2025 Security Misconfiguration

### Supply Chain

* A03:2025 Software Supply Chain Failures

### Cryptography

* A04:2025 Cryptographic Failures

### Input Validation

* A05:2025 Injection

### Architecture and Design

* A06:2025 Insecure Design

### Authentication

* A07:2025 Authentication Failures

### Data Integrity

* A08:2025 Software or Data Integrity Failures

### Logging and Monitoring

* A09:2025 Security Logging and Alerting Failures

### Error Handling

* A10:2025 Mishandling of Exceptional Conditions

---

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0
(<https://creativecommons.org/licenses/by-sa/4.0/>).
Modifications: Restructured into agent-consumable reference format with added
detection and remediation guidance.