OWASP Top 10:2025 · pillar 4 of 6
The classics, demoted
Crypto, injection and insecure design all fell — and none of it means they are solved.
- 10 A04: cryptographic failures, down to fourth Cryptographic Failures fell from #2 to #4. It covers the absence of cryptography, cryptography that is not strong…
- 11 A05: injection fell to fifth, and is not solved Injection fell from #3 to #5. It remains one of the most tested categories, with the greatest number of CVEs of any…
- 12 A06: insecure design slid, for a good reason Insecure Design slid from #4 to #6, overtaken by misconfiguration and supply chain. Introduced in 2021, it covers…
Start this pillar See the whole map
Read against OWASP Top 10:2025 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.