OWASP Top 10 (2025) — Explorer

All ten of the 2025 OWASP risks in one place. Click any category to see what it is, a concrete healthcare-platform example, and the mitigation — with badges for what's new, moved or renamed since 2021, and links to the hands-on lab for each.

Pick a category, then play its attack in the panel below — toggle Secure mode to flip between the broken and the fixed design and watch what changes.

A01:2025Broken Access Control#1 again

Users act outside their permissions — reading or changing what isn't theirs. SSRF is now folded in here.

Logged in as user 1001 — click any order to open it

Fix: Server-side ownership checks, deny-by-default, enforce RBAC, never trust client-supplied ids.

What just happened

▹The OWASP Top 10 is the industry's consensus list of the most critical web-app security risks — design concerns for architects, not just developer bugs.
▹2025 shifted: Security Misconfiguration jumped to #2, Software Supply Chain Failures and Mishandling of Exceptional Conditions are new, SSRF folded into Broken Access Control, and logging now includes alerting.
▹Each category has its own runnable demo. Flip 'Secure mode' and launch the attack to watch the vulnerable version breach and the hardened version hold.