> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025.md).

# owsap-top-10:2025

- [A10 Mishandling of Exceptional Conditions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions.md)
- [Sensitive Data in Error Messages and Debug Code](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions/sensitive-data-in-error-messages-and-debug-code.md): CWE-209, CWE-215, CWE-550, CWE-756
- [Uncaught Exceptions and Improper Recovery](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions/uncaught-exceptions-and-improper-recovery.md): CWE-248, CWE-252, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-703, CWE-754, CWE-755
- [Fail-Open Vulnerabilities](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a10-mishandling-of-exceptional-conditions/fail-open-vulnerabilities.md)
- [A09 Security Logging and Alerting Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a09-security-logging-and-alerting-failures.md)
- [Logging Vulnerabilities](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a09-security-logging-and-alerting-failures/logging-vulnerabilities.md): CWE-117, CWE-221, CWE-223, CWE-532, CWE-778
- [A08 Software or Data Integrity Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures.md)
- [Dependencies and Malicious Code Inclusion](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/dependencies-and-malicious-code-inclusion.md)
- [Embedded Malware and Dynamic Modification](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/embedded-malware-and-dynamic-modification.md)
- [Insecure deserialization](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/insecure-deserialization.md)
- [DLL Hijacking](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a08-software-or-data-integrity-failures/dll-hijacking.md)
- [A07 Authentication Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures.md)
- [JWT Hacking](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/jwt-hacking.md)
- [Hardcoded & Default Credentials](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/hardcoded-and-default-credentials.md): CWE-258, CWE-259, CWE-259, CWE-798, CWE-1392, CWE-1393
- [Authentication Bypass](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/authentication-bypass.md): CWE-288, CWE-289, CWE-290, CWE-302, CWE-305
- [Certificate Validation Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/certificate-validation-failures.md): CWE-295, CWE-297, CWE-298, CWE-299, CWE-346:
- [Session Security](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/session-security.md): CWE-384,  CWE-613, CWE-620, CWE-304, CWE-306
- [Dictionary Attacks and Recovery Exploits](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/dictionary-attacks-and-recovery-exploits.md): CWE-307, CWE-521, CWE-640, CWE-1391, CWE-294
- [Network-Based Authentication Flaws](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/network-based-authentication-flaws.md): CWE-291, CWE-293, CWE-300, CWE-350, CWE-940, CWE-941
- [A06 Insecure Design](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design.md)
- [Race Conditions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/race-conditions.md)
- [HTTP Request Smuggling](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/http-request-smuggling.md)
- [UI Attacks](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/ui-attacks.md)
- [Insecure File Upload and Path Traversal](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/insecure-file-upload-and-path-traversal.md): CWE-73, CWE-434, CWE-646
- [Sensitive Data Storage: Encryption, Caching, and Cookies](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/sensitive-data-storage-encryption-caching-and-cookies.md): CWE-256, CWE-311, CWE-312, CWE-313, CWE-316, CWE-522, CWE-525, CWE-539, CWE-598
- [Privilege Escalation and Trust Boundaries](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/privilege-escalation-and-trust-boundaries.md): CWE-266, CWE-269, CWE-286, CWE-501, CWE-602
- [A05 Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection.md)
- [Cross Site Scripting](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting.md)
- [Cross Site Scripting](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting/cross-site-scripting.md)
- [Exploitation](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting/exploitation.md)
- [Protections](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cross-site-scripting/protections.md)
- [SQL Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/sql-injection.md)
- [SQLmap](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/sql-injection/sqlmap.md)
- [NoSQL Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/nosql-injection.md)
- [CRLF Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/crlf-injection.md)
- [CST Injection ( CSTI )](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cst-injection-csti.md)
- [Command Injection](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/command-injection.md)
- [A04 Cryptographic Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures.md)
- [Weak Algorithms and Inadequate Hashing](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/weak-algorithms-and-inadequate-hashing.md): CWE-327, CWE-326, CWE-328, CWE-759, CWE-760, CWE-916,CWE-780
- [PRNG Failures and Predictable Secrets](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/prng-failures-and-predictable-secrets.md): CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-1241
- [Cryptographic Failure](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/cryptographic-failure.md): this lab covers a lot of basic cwes like CWE-327, CWE-759, CWE-916, CWE-319, CWE-523
- [Weak Encoding for Password](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/weak-encoding-for-password.md): CWE-261
- [Improper Following of a Certificate's Chain of Trust](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/improper-following-of-a-certificates-chain-of-trust.md)
- [Understanding Digital Certificates :  Self-Signed and CA-Signed Certificate \*\*](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/improper-following-of-a-certificates-chain-of-trust/understanding-digital-certificates-self-signed-and-ca-signed-certificate.md): extra knowledge
- [Transport Layer Security (TLS) and SSL \*\*](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/improper-following-of-a-certificates-chain-of-trust/transport-layer-security-tls-and-ssl.md): extra knowledge
- [Clear Text Transmission Of Sensitive Data](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/clear-text-transmission-of-sensitive-data.md)
- [SSLStripping \*\*](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/clear-text-transmission-of-sensitive-data/sslstripping.md): extra knowledge
- [Cryptographic Key Management and Implementation](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/cryptographic-key-management-and-implementation.md): CWE-321, CWE-322, CWE-323, CWE-324, CWE-523, CWE-325, CWE-347, CWE-757, CWE-1240
- [A03 Software Supply Chain Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a03-software-supply-chain-failures.md)
- [Use of Obsolete Function](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a03-software-supply-chain-failures/use-of-obsolete-function.md)
- [Vulnerable and Outdated Components](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a03-software-supply-chain-failures/vulnerable-and-outdated-components.md): senarios cover : CWE-1035, CWE-1329, CWE-1357, CWE-1104, CWE-1395
- [A02 Security Misconfiguration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration.md)
- [Cookie Security](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/cookie-security.md)
- [XML External Entity](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/xml-external-entity.md)
- [Improper Model Validation](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/improper-model-validation.md)
- [Data Transmission Without Encryption](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/data-transmission-without-encryption.md)
- [CORS Miscofigration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/cors-miscofigration.md)
- [Mail Server Misconfiguration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/mail-server-misconfiguration.md)
- [Debug Binary Misconfiguration](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/debug-binary-misconfiguration.md)
- [Exposure of Sensitive Information Through Environment Variables](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a02-security-misconfiguration/exposure-of-sensitive-information-through-environment-variables.md)
- [A01 Broken Access Control](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control.md)
- [Path Traversal](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/path-traversal.md)
- [Open Redirect](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/open-redirect.md)
- [Symlink or Hard Link Following](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/symlink-or-hard-link-following.md)
- [Confused Deputy](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/confused-deputy.md)
- [Incorrect Default Permissions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/incorrect-default-permissions.md)
- [Forced Browsing](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/forced-browsing.md)
- [Server-Side Request Forgery (SSRF)](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/server-side-request-forgery-ssrf.md)
- [CSRF](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf.md)
- [Sensitive Cookie with Improper SameSite Attribute](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf/sensitive-cookie-with-improper-samesite-attribute.md)
- [csrf checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf/csrf-checklist.md)
- [checklists](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists.md)
- [ATO](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/ato.md)
- [idor checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/idor-checklist.md)
- [admin panal checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/admin-panal-checklist.md)
- [bussiness logic checklist](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/bussiness-logic-checklist.md)
- [403 bypass](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/checklists/403-bypass.md)
- [mass assignment](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/mass-assignment.md)