[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Top 20 OWASP Vulnerabilities And How To Fix Them Infographic](/blog/top-20-owasp-vulnerabilities-and-how-to-fix-them) Publish date January 7, 2025 {x} minute read # Top 20 OWASP Vulnerabilities And How To Fix Them Infographic [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-third-party-risk-management) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) The Open Web Application Security Project (OWASP) is a well-established organization dedicated to improving web application security through the creation of tools, documentation, and information—that latter of which includes a yearly [top 10 of web application vulnerabilities](/blog/owasp-top-ten). The following is a compilation of the most recent critical vulnerabilities to surface on its lists, as well as information on how to remediate each of them. ## Top OWASP Vulnerabilities ### 1. SQL Injection **Description:** [SQL injection](https://www.upguard.com/blog/sql-injection) vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically construct a SQL query. SQL Injection may result in data loss or corruption, lack of accountability, or denial of access. Injection can sometimes lead to complete host takeover. **Fix / Recommendation:** Proper server-side input validation must be used for filtering out hazardous characters from user input. Additionally, making use of prepared statements / parameterized stored procedures can ensure that input is processed as text. **Sample Code Snippet (Input Validation):** > String input = request.getParameter ("SeqNo");\ > String characterPattern = "\[0-9a-zA-Z]";\ > If (! input. matches (characterPattern))\ > {\ > out.println (“Invalid Input”);\ > } ### 2. Cross Site (XSS) Scripting **Description:** In these cases, invalid user-controlled data is processed within the application—leading to the execution of malicious scripts. [XSS vulnerabilities](/blog/cross-site-scripting-xss) can allow attackers to capture user information and/or inject HTML code into the vulnerable web application. **Fix / Recommendation:** Proper server-side input validation and output encoding should be employed on both the client and server side to prevent the execution of scripts. Hazardous characters should be filtered out from user input \[e.g.: | , & , ; , $ , % , @ , ' , " , \\' , \\" , <> , () , + , CR (Carriage return, ASCII 0x0d) , LF (Line feed, ASCII 0x0a),(comma sign) , \ ]. **Sample Code Snippet (Encoding Technique):** > \ ### 3. Information Leakage **Description: **The web application may reveal system data or debugging information by raising exceptions or generating error messages. Leakage of system data or debugging information through an output stream or logging function can allow attackers to gain knowledge about the application and craft specialized attacks on the it. **Fix / Recommendation:** * Ensure that error codes and other messages visible by end users do not contain sensitive information. * Sanitize all messages, removing any unnecessary sensitive information.    * Ensure that debugging, error messages, and exceptions are not visible. **Sample Code Snippet:** > catch (Exception e)\ > {\ > if(log.isDebugEnabled()) log.debug (context, EVENTS.ADHOC,\ > "Caught InvalidGSMException Exception -- "\ > \+ e.toString() );\ > } ### 4. Frame Injection **Description:** Improper validation of input parameters could lead to attackers injecting frames to compromise confidential user information. Frame injection is a common method employed in [phishing](/blog/phishing) attacks **Fix / Recommendation:** Use a whitelist of acceptable inputs that strictly conforms to secure specifications **Sample Code Snippet:** > String input = request.getParameter ("input");\ > String character Pattern = "\[./a-zA-Z0-9?"="&]";\ > If (! input. matches (character Pattern))\ > {\ > out.println (“Invalid Input”);\ > } ### 5. URL Redirection **Description: **While it's common for web applications to redirect or forward users to other websites/pages, attackers commonly [exploit](/blog/exploit) vulnerable applications without proper redirect validation in place. This can lead to malicious redirection to an untrusted page. **Fix / Recommendation:** Use a whitelist of acceptable inputs that strictly conform to specifications and for approved URLs or domains used for redirection. **Sample Code Snippet:** > String input = request.getParameter ("input");\ > String character Pattern = "\[./a-zA-Z0-9?"="&]";\ > If (! input. matches (character Pattern))\ > {\ > out.println (“Invalid Input”);\ > } ### 6. Missing Session Timeout **Description:** Attackers may gain unauthorized access to web applications if inactivity timeouts are not configured correctly. **Fix / Recommendation:** Ensure that timeout functionality is properly configured and working. **Sample Code Snippet:** > \\ >      \\ >      \15\\ > \\ > \ ### 7. Sensitive Information Passed as Clear Text in GET URL **Description:** Web applications using GET requests to pass information via the query string are doing so in clear-text. This makes any sensitive information passed with GET visible in browser history and server logs. **Fix / Recommendation:** Using POST instead of GET ensures that confidential information is not visible in the query string parameters. ### 8. Session ID Cookies Not Marked Secure **Description:** If session ID cookies for a web application are marked as secure, the browser will not transmit them over an unencrypted HTTP request. Not marking them as such allows cookies to be accessible and viewable in by attackers in clear text. **Fix / Recommendation:** Make sure that sensitive cookies are set with the "secure" attribute to ensure they are always transmitted over HTTPS. **Sample Code Snippet:** > Cookie cookie = new Cookie("myCookieName");\ > cookie.secure(true); ### 9. Cross Frame Scripting (XFS) **Description: **XFS exploits are used in conjunction with XSS to direct browsers to a web page controlled by attackers. In these cases, the malicious page loads a third-party page in an HTML frame. Scripts on the attacker's page are then able to steal data from the third-party page, unbeknownst to the user. **Fix / Recommendation:**  Proper validation should be used to filter out any malicious input that can be injected into a frame and executed on the user's browser, within the context of the main page frame. **Sample Code Snippet:** > if (top == self) }\ >    document.documentElement.style.display = 'block';\ > }\ > else {\ > top.location = self.location;\ > } ### 10. Sensitive Information Displayed as Clear Text on Screen **Description:** Sensitive information (e.g., passwords, credit card information) should not be displayed as clear text on the screen. In addition to shoulder surfing attacks, [sensitive data](/blog/sensitive-data) stored as clear text often finds its away into [client-side caches](https://www.upguard.com/blog/cache)—which can be easily stolen if discovered. **Fix / Recommendation:** Sensitive information should be masked so that it is not visible to users **Sample Code Snippet:** > \\ ### 11. Sensitive Information Cached **Description:** Browsers typically store a copy of requested items in their caches: web pages, images, and more. This creates a security gap for applications that store, process, and display sensitive data, since attackers gaining access to the user's browser cache have access to any information contained therein. **Fix / Recommendation:** HTTP Cache-Control headers should be used such as Cache-Control: no-cache, no-store Pragma: no-cache. **Sample Code Snippet:** > \\ > \\ > \ ### 12. Inadequate Encryption Strength **Description:** Applications using less than 1024 bit key sizes for [encryption](/blog/encryption) can be exploited via [brute force attacks](/blog/brute-force-attack).  **Fix / Recommendation:** Use a higher version bit key size, 2048 bits or larger. ### 13. CRLF (Carriage Return and Line Feed) Injection **Description:** CRLF exploits occur when malicious content is inserted into the browser's HTTP response headers after an unsuspecting user clicks on a malicious link. Hackers will typically inject malicious code into the user's browser through the web application/server, making casual detection difficult. **Fix / Recommendation:** URL-encode all strings before transmission. Ensure that shell metacharacters and command terminators (e.g., ; CR or LF) are filtered from user data before they are transmitted. **Sample Code Snippet:** > String author = request.getParameter(AUTHOR\_PARAM);\ > Cookie cookie = new Cookie("author", ESAPI.encoder().encodeForURL(author));\ > cookie.setMaxAge(cookieExpiration);\ > response.addCookie(cookie); ### 14. Trust Boundary Violation **Description:** Web applications often mistakenly mix trusted and untrusted data in the same data structures, leading to incidents where unvalidated/unfiltered data is trusted/used. **Fix / Recommendation:** Proper input validation and output encoding should be used on data before moving it into trusted boundaries. **Sample Code Snippet:** > String sessionPolicyId = request.getParameter("id");\ > if(sessionPolicyId.matches("\[0-9a-zA-Z\_]+") {\ > session.setAttribute("sessionPolicyId",sessionPolicyId);\ > } ### 15. Directory Traversal **Description:** By accepting user inputs that control or influence file paths/names used in file system operations, vulnerable web applications could enable attackers to access or modify otherwise protected system resources. **Fix / Recommendation: **A whitelist of acceptable data inputs that strictly conforms to specifications can prevent directory traversal exploits. **Sample Code Snippet:** > String input = request.getParameter("fileName");\ > if (ESAPI.validator().isValidFileName(String context, String input, boolean allowNull))\ > {\ > File file = new File(input);\ > } ### 16. Session Fixation **Description:** In these cases, vulnerable web applications authenticate users without first destroying existing sessions associated with said users. This allows attackers to access users' accounts by hijacking their active sessions. **Fix / Recommendation**: Destroy any existing session identifiers prior to authorizing a new user session. **Sample Code Snippet:** > session.invalidate();\ > session=request.getSession(true); ### 17. Use of a Risky Cryptographic Algorithm **Description:** Web applications using non-standard algorithms are weakly encrypted, allowing hackers to gain access relatively easily using brute force methods. **Fix / Recommendation:** When storing or transmitting sensitive data, use strong, up-to-date cryptographic algorithms to encrypt that data before sending/storing. **Sample Code Snippet: ** > MessageDigest md = MessageDigest.getInstance("SHA-256");\ > FileInputStream fis = new FileInputStream("c:\\\loging.log");\ > byte\[] dataBytes = new byte\[1024];\ > int nread = 0;\ > while ((nread = fis.read(dataBytes)) != -1) {\ >   md.update(dataBytes, 0, nread);\ > };\ > byte\[] mdbytes = md.digest(); ### 18. Credentials Management **Description:** Storing passwords in plain text can easily result in system compromises— especially if configuration/source files are in question. **Fix / Recommendation:** Avoid storing passwords in easily accessible locations. Use cryptographic hashes as an alternative to plain-text. ### 19. SQL Injection Hibernate **Description:** Hibernate is a popular ORM framework for Java—as such, it provides several methods that permit execution of native SQL queries. Attackers commonly exploit Hibernate to execute malicious, dynamically-created SQL statements. **Fix / Recommendation:** Proper server-side input validation can serve as a basic defense to filter out hazardous characters. Prepared statements/parameterized stored procedures can be used to render data as text prior to processing or storage. **Sample Code Snippet: ** > Query hqlQuery = session.createQuery("select product from Orders as orders where orders.id =?");\ > List results = hqlQuery.setString(0, "123-ADB-567-QTWYTFDL").list(); ### 20. Improper Resource Shutdown or Release **Description:** Improper resource shutdown occurs when a web application fails to release a system resource before it is made available for reuse. A [denial of service attack (Dos)](https://www.upguard.com/blog/what-is-a-ddos-attack) can be then launched by depleting the server's resource pool. **Fix / Recommendation:** Any created or allocated resources must be properly released after use.  **Sample Code Snippet: ** > try {\ > Connection con = DriverManager.getConnection(some\_connection\_string);\ > }\ > catch ( Exception e ) {\ > log( e );\ > }\ > finally {\ > if( stmt != null )\ >      stmt.close();\ >      con.close()   } In short, the 20 items listed above are the most commonly encountered web application vulnerabilities, per OWASP. While many of these can be remediated through safer coding practices, some may require the identifying of relevant vendor-specific patches. This ultimately depends on what specific technologies, frameworks, and packages are being used in your web application. Need an easier way to discover vulnerabilities in your web application? Powered by policy-driven testing, UpGuard can automatically scan and monitor your web application for misconfigurations and security gaps. ## Infographic   eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) September 28, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) January 7, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)