Cheat sheet
OWASP Top 10
The reference rankings for discussing the risks of web applications and LLM-based applications. Useful to classify a finding in a report.
Web applications: 2025 edition
The current edition, published late 2025. Two new categories: the software supply chain and mishandling of exceptional conditions. SSRF is now part of access control.
| Rank | Category | In short |
|---|---|---|
| A01 | Broken Access Control | Access to data or functions without the right to it (IDOR, horizontal or vertical escalation, SSRF). |
| A02 | Security Misconfiguration | Default settings, unnecessary features enabled, overly verbose error messages. |
| A03 | Software Supply Chain Failures | Compromised or vulnerable dependencies, build tools or third-party components. |
| A04 | Cryptographic Failures | Sensitive data poorly encrypted or weak algorithms. |
| A05 | Injection | Untrusted data interpreted as code: SQL, commands, XSS… |
| A06 | Insecure Design | A design flaw that the implementation cannot fix. |
| A07 | Authentication Failures | Weak passwords allowed, poorly managed sessions, no MFA. |
| A08 | Software or Data Integrity Failures | Code or data accepted without integrity checks. |
| A09 | Security Logging and Alerting Failures | Events not logged or not alerted on: the attack goes unnoticed. |
| A10 | Mishandling of Exceptional Conditions | Poorly handled errors and edge cases that leave the application in a dangerous state. |
Web applications: 2021 edition
Still quoted in many modules and reports.
| Rank | Category |
|---|---|
| A01 | Broken Access Control |
| A02 | Cryptographic Failures |
| A03 | Injection |
| A04 | Insecure Design |
| A05 | Security Misconfiguration |
| A06 | Vulnerable and Outdated Components |
| A07 | Identification and Authentication Failures |
| A08 | Software and Data Integrity Failures |
| A09 | Security Logging and Monitoring Failures |
| A10 | Server-Side Request Forgery (SSRF) |
LLM applications: 2025 edition
| Rank | Category | In short |
|---|---|---|
| LLM01 | Prompt Injection | Instructions, direct or hidden in content, hijack the model. |
| LLM02 | Sensitive Information Disclosure | The model reveals sensitive data. |
| LLM03 | Supply Chain | Compromised third-party models, data or libraries. |
| LLM04 | Data and Model Poisoning | Tampered training data or model. |
| LLM05 | Improper Output Handling | Model output used by the application without checks. |
| LLM06 | Excessive Agency | Too many tools or rights granted to the model. |
| LLM07 | System Prompt Leakage | The system prompt leaks, along with what it contains. |
| LLM08 | Vector and Embedding Weaknesses | Flaws in vector databases and RAG. |
| LLM09 | Misinformation | False answers presented as reliable. |
| LLM10 | Unbounded Consumption | Unbounded usage: costs, denial of service, model extraction. |