Web application security remains a critical priority for companies handling sensitive data and connected systems. To guide organizations, developers, and security professionals, OWASP (Open Web Application Security Project) updated the OWASP Top 10 in 2025, a list of the most relevant vulnerabilities affecting modern web applications.
This new edition introduces two new categories, expands one, and renames several to better reflect current threats. In this article, we explore each vulnerability in the 2025 Top 10 and how to mitigate them to protect your application.
OWASP Top 10: 2025
1. Broken Access Control (Controle de Acesso Quebrado)
This vulnerability occurs when users can access resources or perform actions outside their permission profile. This includes accessing other users' data, modifying records without authorization, or performing unauthorized administrative actions. The failure can happen due to misconfigured routes, exposed endpoints, or inconsistent validations.
Example: A customer can access another user's account simply by changing the ID in the URL.
Mitigation: Implement access validations on the server side, apply the principle of least privilege, and conduct continuous authorization testing.
2. Security Misconfiguration (Configuração de Segurança Inadequada)
This refers to configuration errors in servers, applications, containers, frameworks, or poorly defined permissions. It is one of the most common failures and can leave systems completely exposed.
Example: An administration panel left open on the internet without authentication.
Mitigation: Automate configuration reviews, apply hardening on servers, and use security tools like Infrastructure as Code (IaC) with validations.
3. Software Supply Chain Failures (Falhas na Cadeia de Suprimentos de Software)
This new category broadens the focus to threats occurring in external libraries, repositories, CI/CD pipelines, or software artifacts manipulated by third parties. Over-reliance on external dependencies without validation can compromise the entire application.
Example: A compromised NPM package containing malicious code that collects user data.
Mitigation: Validate package integrity with hashes/signatures, use trusted repositories, review dependencies, and apply version control with vulnerability alerts.
4. Cryptographic Failures (Falhas Criptográficas)
This involves the incorrect, nonexistent, or insecure use of cryptographic mechanisms, such as weak algorithms, lack of encryption for sensitive data, or poor key management.
Example: Storing passwords without encryption or using MD5/SHA1.
Mitigation: Use modern algorithms (like SHA-256, AES, TLS 1.3), apply salting to passwords, and protect keys with HSMs or secure vaults.
5. Injection (Injeção)
This remains one of the most exploited vulnerabilities. It involves inserting malicious commands into inputs that are processed by interpreters, such as SQL, NoSQL, system commands, LDAP, among others.
Example: A vulnerable login field that allows SQL command execution, accessing or deleting data.
Mitigation: Use parameterized queries (prepared statements), validate and sanitize inputs, and apply WAFs where applicable.
6. Insecure Design (Design Inseguro)
Unlike implementation flaws, this refers to vulnerabilities that arise from the application's design phase when security is not considered in the design of flows, logic, and functionalities.
Example: An authentication system that does not require email verification for critical changes.
Mitigation: Incorporate security from the requirements phase, conduct threat modeling, and validate adverse use cases.
7. Authentication Failures (Falhas de Autenticação)
This includes errors in login mechanisms, session management, password recovery, and identity verification. Exploitation can allow unauthorized access and account compromise.
Example: Login without attempt limitations, allowing brute force attacks.
Mitigation: Adopt multi-factor authentication (MFA), limit attempts, protect sessions with secure tokens, and use established libraries.
8. Software or Data Integrity Failures (Falhas de Integridade de Software ou Dados)
This category involves failures to ensure that software and data have not been improperly manipulated. This includes compromised builds, insecure updates, and data altered in transit without validation.
Example: A system that automatically updates JavaScript scripts from a CDN without validation.
Mitigation: Sign packages, validate file integrity (checksums), apply version control, and monitor for suspicious changes.
9. Logging & Alerting Failures (Falhas de Log e Alertas)
Errors in logging security events or generating relevant alerts can hinder timely incident detection. Logs without context or missing alerts make rapid responses difficult.
Example: A malicious login failure not logged or alerted to the security team.
Mitigation: Implement SIEMs, log critical events with context, and configure real-time alerts for anomalies.
10. Mishandling of Exceptional Conditions (Tratamento Inadequado de Condições Excepcionais)
This new category covers failures in handling errors, exceptions, and unexpected situations such as logic errors, “fail-open” failures, and revealing error messages.
Example: Displaying a complete stack trace to the user in case of an unexpected error.
Mitigation: Handle exceptions securely, hide internal messages, and implement controlled fallback logic.
Conclusion
The OWASP Top 10 of 2025 reinforces that cybersecurity must be treated as an essential part of the development cycle. HackerSec is a reference in offensive cybersecurity and a pioneer in the Continuous Pentest model in Brazil, anticipating a trend that is now solidifying among large corporations.
Discover our services: https://hackersec.com/empresas/