The entries are categories of CWEs
Each entry is a category grouping many Common Weakness Enumerations, not a single vulnerability. A01 covers roughly forty CWEs; A05 Injection covers dozens, spanning cross-site scripting at high frequency and low impact and SQL injection at low frequency and high impact.
Why it is like this
Grouping by root cause rather than symptom keeps the list stable as individual attack names come and go, and keeps it short enough to remember.
Not to be confused with
Ten vulnerabilities to test for. Two findings in the same category can have almost nothing in common operationally — and the project is explicit that with software this complex, the categories overlap.
In practice
Because categories bundle, an average incidence rate for a category tells you very little about any individual weakness inside it.
Source: OWASP Top 10:2025 — A05:2025 Injection. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Odd one out Check yourself
Three of these describe a Top 10 entry. Which does not?
Show the answer
A single, specific, individually testable vulnerability
Entries are categories. The project says outright that creating ten categories without some overlap is basically impossible.