Broken Access Control
Users can act outside their intended permissions - IDOR, missing function-level checks, forced browsing, tenant boundary bypass.
Versioned taxonomy
OWASP Web Top 10:2021
The preserved 2021 web application security taxonomy, linked to Vulns.co tools and playbooks.
Cryptographic Failures
Sensitive data exposed through weak/missing crypto - cleartext transport, weak hashing, hardcoded keys, predictable tokens.
Injection
Untrusted input alters a query or command - SQLi, NoSQLi, command injection, and XSS (a client-side injection).
Insecure Design
Flaws in the design itself - missing rate limits, weak business logic, unsafe workflows that no amount of clean code fixes.
Security Misconfiguration
Default configs, verbose errors, open cloud storage, unnecessary features, and missing hardening headers.
Vulnerable & Outdated Components
Known-vulnerable libraries, frameworks, and appliances - the CVE feed is your friend here.
Identification & Authentication Failures
Weak auth - credential stuffing, weak reset flows, poor session handling, and bypassable MFA.
Software & Data Integrity Failures
Unverified updates, insecure deserialization, and CI/CD or dependency tampering.
Security Logging & Monitoring Failures
Hard to test from outside, but note where actions appear untracked or where log injection is possible.
Server-Side Request Forgery (SSRF)
The app fetches a user-supplied URL, letting you reach internal services and cloud metadata.
Primary source and edition policy
Vulns.co preserves older editions at stable URLs and does not silently rewrite historical mappings.
Open the official OWASP edition ↗