-green?style=flat-square){kind=icon}
The missing OWASP Top 10:2025 Excel checklist.
All 249 officially mapped CWEs across all 10 risk categories — each with a plain-English description, 3 real-world attack examples, actionable prevention guidance, and a ready-to-use pentest tracking layout.
The OWASP Top 10:2025 was released in late 2025. Unlike previous editions, the community had not yet produced a structured, CWE-complete Excel checklist for it. Most existing checklists either target the 2021 edition or are built around the OWASP Web Security Testing Guide (WSTG) test case IDs rather than CWE mappings.
This checklist fills that gap.
The workbook contains 3 sheets:
The main working sheet. One row per CWE, covering all 10 categories.
| Column | Content |
|---|---|
| # | Sequential row number |
| OWASP ID | Category badge (A01–A10), colour-coded per category |
| Category | Full OWASP risk category name |
| CWE ID | MITRE CWE identifier |
| CWE Name | Official MITRE CWE weakness name |
| Description | Plain-English summary of the weakness and its impact |
| Example 1 | Real-world attack scenario / proof-of-concept |
| Example 2 | Second distinct attack variant |
| Example 3 | Third scenario or tool-based example |
| Prevention | Actionable remediation and prevention guidance |
| Status | ☐ Not Tested / ✅ Pass / ❌ Fail / ➖ N/A |
| Severity | Critical / High / Medium / Low / Informational |
| Tester Notes | Free-text field for findings, CVEs, tool output |
Quick-reference overview of all 10 categories with CWE counts and notable CWEs.
Status values, severity definitions, and reference links.
| ID | Category | CWEs |
|---|---|---|
| A01 | Broken Access Control | 40 |
| A02 | Security Misconfiguration | 16 |
| A03 | Software Supply Chain Failures | 6 |
| A04 | Cryptographic Failures | 32 |
| A05 | Injection | 37 |
| A06 | Insecure Design | 39 |
| A07 | Authentication Failures | 36 |
| A08 | Software or Data Integrity Failures | 14 |
| A09 | Security Logging and Alerting Failures | 5 |
| A10 | Mishandling of Exceptional Conditions | 24 |
| Total | 249 |
- Download the
.xlsxfile from this repository - Open in Microsoft Excel, LibreOffice Calc, or Google Sheets
- Filter by OWASP ID to focus on a specific category
- Update the Status column as you test each item:
☐ Not Tested→ starting state🔄 In Progress→ currently testing✅ Pass→ no vulnerability found❌ Fail→ vulnerability confirmed, needs remediation➖ N/A→ not applicable to the scope
- Add findings in the Tester Notes column (CVE IDs, tool output, screenshots reference, remediation steps)
- Filter by Severity to prioritise Critical and High findings for the report
- Penetration testers running web application assessments
- Security engineers conducting internal security reviews
- AppSec teams performing threat modelling and design reviews
- Bug bounty hunters using a structured approach to coverage
- Students and learners studying the OWASP Top 10:2025
All CWE mappings were verified directly from:
- OWASP Top 10:2025 official category pages — each A01–A10 page's "List of Mapped CWEs" section
- MITRE CWE database — cross-referenced via the OWASP 2025 category entries (CWE-1440 through CWE-1449)
The CWE counts match the official score tables published by OWASP:
A01:40 · A02:16 · A03:6 · A04:32 · A05:37 · A06:39 · A07:36 · A08:14 · A09:5 · A10:24 = 249 total
├── OWASP_Top10_2025_Complete_249CWEs.xlsx # Main checklist file
└── README.md # This file
Contributions are welcome. If you find a missing CWE, incorrect mapping, or want to improve the examples or prevention guidance, please:
- Fork the repository
- Make your changes
- Open a Pull Request with a description of what was changed and why
For issues or suggestions, open a GitHub Issue.
This checklist is an independent community resource built on top of publicly available data.
- OWASP Top 10:2025 content and category mappings are sourced from owasp.org/Top10/2025 and are licensed under Creative Commons Attribution 3.0 Unported.
- CWE names and identifiers are sourced from cwe.mitre.org and are copyright © The MITRE Corporation.
- This checklist (examples, descriptions, prevention guidance, formatting) is released under Creative Commons Attribution 4.0 International (CC BY 4.0).
You are free to use, share, and adapt this checklist for commercial and non-commercial purposes, as long as you provide appropriate credit.
If you found this useful, consider starring the repo — it helps others find it too.
Data sourced from owasp.org/Top10/2025 and cwe.mitre.org. This is a community resource and is not officially affiliated with OWASP or MITRE.