{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "metadata": {
    "title": "OWASP Top 10:2025 Cross-Framework Crosswalk",
    "version": "1.0.0",
    "publisher": "Aivistix Research",
    "author": "Aivistix Security Research",
    "license": "CC BY 4.0",
    "retrieved": "2026-07-08",
    "description": "A machine-readable mapping of the OWASP Top 10:2025 risk categories to CWE, representative CVE, NVD-verified CVSS v3.1 base score + vector, MITRE ATT&CK techniques, NIST SP 800-53 Rev.5, NIST CSF 2.0, ISO/IEC 27001:2022 Annex A, PCI DSS v4.0, and GDPR articles.",
    "methodology": "OWASP rankings taken from the official OWASP Top 10:2025 (released Nov 2025). CVSS base scores and vector strings were retrieved on 2026-07-08 from the NVD REST API v2.0 (services.nvd.nist.gov) and reflect the PRIMARY (nvd@nist.gov) analysis unless a 'cna_note' field states otherwise. Where an incident (not a CVE) is cited, no CVSS score is asserted. Framework control references cite the most directly applicable control family/clause; they are illustrative, not exhaustive.",
    "sources": {
      "owasp": "https://owasp.org/Top10/2025/",
      "nvd_api": "https://services.nvd.nist.gov/rest/json/cves/2.0",
      "cwe": "https://cwe.mitre.org/",
      "attack": "https://attack.mitre.org/",
      "cvss": "https://www.first.org/cvss/",
      "nist_800_53": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
      "nist_csf": "https://www.nist.gov/cyberframework",
      "iso_27001": "https://www.iso.org/standard/27001",
      "pci_dss": "https://www.pcisecuritystandards.org/",
      "gdpr": "https://gdpr-info.eu/"
    }
  },
  "categories": [
    {
      "id": "A01:2025",
      "rank": 1,
      "title": "Broken Access Control",
      "status": "unchanged (#1); absorbed SSRF from the 2021 list",
      "depth": "deep-dive",
      "summary": "The application fails to enforce what an authenticated user is permitted to do — IDOR, privilege escalation, forced browsing, and (new for 2025) server-side request forgery.",
      "cwe": [
        {"id": "CWE-284", "name": "Improper Access Control"},
        {"id": "CWE-862", "name": "Missing Authorization"},
        {"id": "CWE-863", "name": "Incorrect Authorization"},
        {"id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key (IDOR)"},
        {"id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)"}
      ],
      "example": {
        "type": "cve",
        "id": "CVE-2023-22515",
        "product": "Atlassian Confluence Data Center & Server",
        "cvss_v31_nvd": 9.8,
        "cvss_v31_vector_nvd": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "severity_nvd": "Critical",
        "cna_note": "Atlassian (CNA) scored this 10.0 using CVSS v3.0 with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (scope Changed). The 0.2-point difference is entirely the Scope metric.",
        "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-22515"
      },
      "attack": ["T1548", "T1068", "T1190"],
      "nist_800_53": ["AC-3 Access Enforcement", "AC-6 Least Privilege", "AC-4 Information Flow Enforcement"],
      "nist_csf_2_0": "PR.AA Identity Management, Authentication & Access Control",
      "iso_27001_2022": ["A.5.15 Access control", "A.8.3 Information access restriction"],
      "pci_dss_v4_0": "Req. 7 — Restrict access to system components and cardholder data by business need-to-know",
      "gdpr": ["Art. 25 Data protection by design and by default", "Art. 32 Security of processing"]
    },
    {
      "id": "A02:2025",
      "rank": 2,
      "title": "Security Misconfiguration",
      "status": "up from #5 (2021)",
      "depth": "deep-dive",
      "summary": "Systems insecure because of how they are set up — default credentials, verbose errors, unnecessary features, permissive cloud storage, over-broad IAM, missing hardening.",
      "cwe": [
        {"id": "CWE-16", "name": "Configuration"},
        {"id": "CWE-1188", "name": "Insecure Default Initialization of Resource"},
        {"id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource"}
      ],
      "example": {
        "type": "incident",
        "id": "Capital One (2019)",
        "product": "Misconfigured WAF -> SSRF -> AWS instance metadata",
        "cvss_v31_nvd": null,
        "cvss_v31_vector_nvd": null,
        "severity_nvd": "Not a CVE — no CVSS score applies",
        "impact": "~106 million customer records exposed",
        "note": "An incident, not a catalogued CVE; CVSS is not defined for incidents. Root cause was a misconfigured web application firewall abused via SSRF to reach the cloud metadata service and steal credentials.",
        "source": "https://www.cisa.gov/news-events/cybersecurity-advisories"
      },
      "attack": ["T1190", "T1078", "T1552.005"],
      "nist_800_53": ["CM-6 Configuration Settings", "CM-7 Least Functionality", "SC-7 Boundary Protection"],
      "nist_csf_2_0": "PR.PS Platform Security; ID.AM Asset Management",
      "iso_27001_2022": ["A.8.9 Configuration management", "A.8.20 Networks security"],
      "pci_dss_v4_0": "Req. 2 — Apply secure configurations to all system components",
      "gdpr": ["Art. 32 Security of processing"]
    },
    {
      "id": "A03:2025",
      "rank": 3,
      "title": "Software Supply Chain Failures",
      "status": "NEW / expanded from 'Vulnerable and Outdated Components' (2021)",
      "depth": "deep-dive",
      "summary": "Risk inherited from code you did not write — open-source libraries, transitive dependencies, build tooling, CI/CD pipelines, and vendor updates.",
      "cwe": [
        {"id": "CWE-1104", "name": "Use of Unmaintained Third Party Components"},
        {"id": "CWE-506", "name": "Embedded Malicious Code"},
        {"id": "CWE-1357", "name": "Reliance on Insufficiently Trustworthy Component"}
      ],
      "example": {
        "type": "cve",
        "id": "CVE-2021-44228",
        "product": "Apache Log4j 2 (Log4Shell)",
        "cvss_v31_nvd": 10.0,
        "cvss_v31_vector_nvd": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "severity_nvd": "Critical",
        "source": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
      },
      "example_secondary": {
        "type": "cve",
        "id": "CVE-2024-3094",
        "product": "XZ Utils / liblzma backdoor",
        "cvss_v31_nvd": 10.0,
        "cvss_v31_vector_nvd": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "severity_nvd": "Critical",
        "source": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"
      },
      "attack": ["T1195", "T1195.001", "T1195.002", "T1199"],
      "nist_800_53": ["SR-3 Supply Chain Controls and Processes", "SR-4 Provenance", "SA-12 (legacy) Supply Chain Protection"],
      "nist_csf_2_0": "GV.SC Cybersecurity Supply Chain Risk Management",
      "iso_27001_2022": ["A.5.19 Information security in supplier relationships", "A.5.21 Managing information security in the ICT supply chain", "A.8.30 Outsourced development"],
      "pci_dss_v4_0": "Req. 6.3.2 — Maintain an inventory of bespoke and third-party software components",
      "gdpr": ["Art. 28 Processor and sub-processor obligations"],
      "assurance": ["SLSA (https://slsa.dev/)", "NIST SSDF SP 800-218", "SBOM: SPDX / CycloneDX"]
    },
    {
      "id": "A04:2025",
      "rank": 4,
      "title": "Cryptographic Failures",
      "status": "down from #2 (2021); formerly 'Sensitive Data Exposure'",
      "depth": "deep-dive",
      "summary": "Failure to protect data in transit and at rest — no encryption, weak/outdated algorithms, weak keys, hard-coded secrets, plaintext transmission.",
      "cwe": [
        {"id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm"},
        {"id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information"},
        {"id": "CWE-259", "name": "Use of Hard-coded Password"},
        {"id": "CWE-331", "name": "Insufficient Entropy"}
      ],
      "example": {
        "type": "cve",
        "id": "CVE-2014-0160",
        "product": "OpenSSL 'Heartbleed'",
        "cvss_v31_nvd": 7.5,
        "cvss_v31_vector_nvd": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "cvss_v2_nvd": 5.0,
        "cvss_v2_vector_nvd": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
        "severity_nvd": "High (v3.1) / Medium (v2)",
        "source": "https://nvd.nist.gov/vuln/detail/CVE-2014-0160"
      },
      "attack": ["T1040", "T1552", "T1557"],
      "nist_800_53": ["SC-8 Transmission Confidentiality and Integrity", "SC-13 Cryptographic Protection", "SC-28 Protection of Information at Rest"],
      "nist_csf_2_0": "PR.DS Data Security",
      "iso_27001_2022": ["A.8.24 Use of cryptography", "A.5.33 Protection of records"],
      "pci_dss_v4_0": "Req. 3 — Protect stored account data; Req. 4 — Strong cryptography during transmission",
      "gdpr": ["Art. 32(1)(a) Encryption and pseudonymisation of personal data"]
    },
    {
      "id": "A05:2025",
      "rank": 5,
      "title": "Injection",
      "status": "down from #1 (2017) / #3 (2021)",
      "depth": "deep-dive",
      "summary": "Untrusted input interpreted as a command — SQL, OS command, LDAP, NoSQL injection, and cross-site scripting (XSS).",
      "cwe": [
        {"id": "CWE-89", "name": "SQL Injection"},
        {"id": "CWE-79", "name": "Cross-site Scripting (XSS)"},
        {"id": "CWE-78", "name": "OS Command Injection"},
        {"id": "CWE-94", "name": "Improper Control of Generation of Code (Code Injection)"}
      ],
      "example": {
        "type": "cve",
        "id": "CVE-2023-34362",
        "product": "Progress MOVEit Transfer (SQL injection)",
        "cvss_v31_nvd": 9.8,
        "cvss_v31_vector_nvd": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "severity_nvd": "Critical",
        "note": "Weaponised at scale by the Cl0p ransomware group; impact driven by ubiquity and threat-actor operationalisation, not by an exceptionally high base score.",
        "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-34362"
      },
      "attack": ["T1190", "T1059", "T1505.003"],
      "nist_800_53": ["SI-10 Information Input Validation", "SI-15 Information Output Filtering"],
      "nist_csf_2_0": "PR.PS Platform Security (secure development)",
      "iso_27001_2022": ["A.8.28 Secure coding", "A.8.26 Application security requirements"],
      "pci_dss_v4_0": "Req. 6.2.4 — Protect against injection and related software attacks",
      "gdpr": ["Art. 32 Security of processing"]
    },
    {
      "id": "A06:2025",
      "rank": 6,
      "title": "Insecure Design",
      "status": "down from #4 (2021)",
      "depth": "summary",
      "summary": "Flaws rooted in missing or ineffective security design and threat modelling — the system is doing exactly what it was designed to do, but the design itself is unsafe. Cannot be patched away; must be re-designed.",
      "cwe": [
        {"id": "CWE-657", "name": "Violation of Secure Design Principles"},
        {"id": "CWE-501", "name": "Trust Boundary Violation"},
        {"id": "CWE-602", "name": "Client-Side Enforcement of Server-Side Security"}
      ],
      "example": {"type": "class", "id": "Business-logic & design flaws", "note": "Design-level weaknesses are not represented by a single CVE; they surface as recurring logic-abuse patterns."},
      "attack": ["T1190"],
      "nist_800_53": ["PL-8 Security and Privacy Architectures", "SA-8 Security and Privacy Engineering Principles", "SA-3 System Development Life Cycle"],
      "nist_csf_2_0": "GV.SC; PR.PS (secure SDLC)",
      "iso_27001_2022": ["A.8.25 Secure development life cycle", "A.8.27 Secure system architecture and engineering principles"],
      "pci_dss_v4_0": "Req. 6.2 — Bespoke and custom software developed securely (incl. threat modelling)",
      "gdpr": ["Art. 25 Data protection by design and by default"]
    },
    {
      "id": "A07:2025",
      "rank": 7,
      "title": "Authentication Failures",
      "status": "renamed from 'Identification and Authentication Failures' (2021)",
      "depth": "summary",
      "summary": "Weaknesses in confirming identity — credential stuffing, brute force, weak/absent MFA, session fixation, exposed session IDs, hard-coded credentials.",
      "cwe": [
        {"id": "CWE-287", "name": "Improper Authentication"},
        {"id": "CWE-306", "name": "Missing Authentication for Critical Function"},
        {"id": "CWE-798", "name": "Use of Hard-coded Credentials"},
        {"id": "CWE-384", "name": "Session Fixation"}
      ],
      "example": {"type": "class", "id": "Authentication-bypass CVEs", "note": "Authentication-bypass flaws are routinely rated Critical; specific scores omitted here rather than asserted without NVD verification."},
      "attack": ["T1110", "T1078", "T1556"],
      "nist_800_53": ["IA-2 Identification and Authentication (organizational users)", "IA-5 Authenticator Management", "AC-7 Unsuccessful Logon Attempts"],
      "nist_csf_2_0": "PR.AA Identity Management, Authentication & Access Control",
      "iso_27001_2022": ["A.5.17 Authentication information", "A.8.5 Secure authentication"],
      "pci_dss_v4_0": "Req. 8 — Identify users and authenticate access (incl. 8.3 MFA)",
      "gdpr": ["Art. 32 Security of processing"],
      "related_standard": "NIST SP 800-63B Digital Identity Guidelines"
    },
    {
      "id": "A08:2025",
      "rank": 8,
      "title": "Software or Data Integrity Failures",
      "status": "unchanged (#8, 2021)",
      "depth": "summary",
      "summary": "Code and data trusted without verifying integrity — unsigned updates, insecure deserialization, untrusted CI/CD plugins. Overlaps with, and reinforces, supply-chain risk.",
      "cwe": [
        {"id": "CWE-502", "name": "Deserialization of Untrusted Data"},
        {"id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere"},
        {"id": "CWE-494", "name": "Download of Code Without Integrity Check"},
        {"id": "CWE-345", "name": "Insufficient Verification of Data Authenticity"}
      ],
      "example": {"type": "class", "id": "Insecure deserialization / unsigned updates", "note": "See also A03 supply-chain examples (Log4Shell, XZ)."},
      "attack": ["T1195.002", "T1554", "T1505"],
      "nist_800_53": ["SI-7 Software, Firmware, and Information Integrity", "SA-10 Developer Configuration Management", "SR-4 Provenance"],
      "nist_csf_2_0": "PR.DS Data Security; GV.SC",
      "iso_27001_2022": ["A.8.32 Change management", "A.8.31 Separation of development, test and production"],
      "pci_dss_v4_0": "Req. 6.3 and Req. 11.5 — Change/tamper detection",
      "gdpr": ["Art. 32 (integrity of processing)"],
      "assurance": ["Code signing", "SLSA provenance", "Subresource Integrity (SRI)"]
    },
    {
      "id": "A09:2025",
      "rank": 9,
      "title": "Security Logging and Alerting Failures",
      "status": "renamed from 'Security Logging and Monitoring Failures' (2021)",
      "depth": "summary",
      "summary": "The inability to detect, alert on, and respond to an attack. A detection gap rather than an exploit — it turns a contained incident into a breach because nobody sees it in time.",
      "cwe": [
        {"id": "CWE-778", "name": "Insufficient Logging"},
        {"id": "CWE-223", "name": "Omission of Security-relevant Information"},
        {"id": "CWE-532", "name": "Insertion of Sensitive Information into Log File"},
        {"id": "CWE-117", "name": "Improper Output Neutralization for Logs"}
      ],
      "example": {"type": "class", "id": "Detection gap", "note": "Measured indirectly by attacker dwell time; not scored by CVSS because it is an absence of control, not a vulnerable component."},
      "attack": ["T1562.008", "T1070"],
      "nist_800_53": ["AU-2 Event Logging", "AU-6 Audit Record Review, Analysis, and Reporting", "AU-12 Audit Record Generation", "IR-4 Incident Handling"],
      "nist_csf_2_0": "DE.CM Continuous Monitoring; DE.AE Adverse Event Analysis; RS.MA Incident Management",
      "iso_27001_2022": ["A.8.15 Logging", "A.8.16 Monitoring activities"],
      "pci_dss_v4_0": "Req. 10 — Log and monitor all access to system components and cardholder data",
      "gdpr": ["Art. 33 Notification of a personal data breach (you cannot report what you cannot detect)"],
      "related_standard": "NIST SP 800-92 Guide to Computer Security Log Management"
    },
    {
      "id": "A10:2025",
      "rank": 10,
      "title": "Mishandling of Exceptional Conditions",
      "status": "NEW in 2025",
      "depth": "summary",
      "summary": "Improper handling of errors, exceptions, and edge cases — uncaught exceptions that crash or fail-open, error messages that leak internals, and unchecked error conditions that silently continue. A brand-new 2025 category reflecting resilience and fail-safe design.",
      "cwe": [
        {"id": "CWE-755", "name": "Improper Handling of Exceptional Conditions"},
        {"id": "CWE-248", "name": "Uncaught Exception"},
        {"id": "CWE-390", "name": "Detection of Error Condition Without Action"},
        {"id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information"}
      ],
      "example": {"type": "class", "id": "Fail-open / verbose-error patterns", "note": "New category; direct CVE mapping is still maturing. Impact ranges from information disclosure to denial of service and security-control bypass."},
      "attack": ["T1499", "T1211"],
      "nist_800_53": ["SI-11 Error Handling", "SI-10 Information Input Validation"],
      "nist_csf_2_0": "PR.PS Platform Security",
      "iso_27001_2022": ["A.8.28 Secure coding"],
      "pci_dss_v4_0": "Req. 6.2.4 — Software engineering techniques prevent/mitigate common attacks incl. improper error handling",
      "gdpr": ["Art. 32 Security of processing"]
    }
  ]
}