OWASP Top 10:2025, explained

#	Category	What it looks like on an SME site
A01	Broken Access Control	Admin pages reachable without login, other customers' bookings viewable by changing an ID in the URL. SSRF is now part of this category.
A02	Security Misconfiguration	Missing security headers, default credentials, directory listing, verbose error pages, public backup files.
A03	Software Supply Chain Failures	Outdated plugins and themes, abandoned npm packages, third-party scripts loaded from unvetted CDNs.
A04	Cryptographic Failures	Forms over HTTP, weak TLS, passwords stored without proper hashing.
A05	Injection	SQL injection in a search box; cross-site scripting (XSS) in a contact form or review widget.
A06	Insecure Design	Password reset flows that can be abused; no rate limits on booking or coupon endpoints.
A07	Authentication Failures	No MFA on the CMS admin, unlimited login attempts, shared admin accounts.
A08	Software or Data Integrity Failures	Scripts loaded without integrity checks; unsigned updates; insecure deserialisation.
A09	Security Logging & Alerting Failures	No logs of admin logins, or logs nobody reviews and no alerts.
A10	Mishandling of Exceptional Conditions	Errors that leak stack traces, or failures that "fail open" and skip a security check.

What a passive scan can and can't see

Passive checks reliably surface parts of A02 (headers, disclosure), A04 (TLS/HTTPS), A03 (visible outdated libraries) and A08 (scripts without Subresource Integrity). A01, A05, A06 and A07 can't be judged from public signals; for those, consider asking a qualified security professional.