Risk is not the same thing as a vulnerability
These two words get swapped every day, and that confusion is why security meetings stall.
A vulnerability is a property of the code: this query concatenates a string, that endpoint never checks ownership. It is either true or false, and it does not change when you change your mind.
Risk is a product: likelihood of exploitation × damage if exploited. The same SQL injection carries wildly different risk in an internal blog and in a payment gateway.
Why the distinction matters to somebody writing code: it is what decides the order you fix things in. A scanner list of 200 findings cannot be ordered by looking at vulnerabilities alone; it orders itself the moment you ask "which of these touches real user data".
The OWASP Top 10 is not a list of the most common vulnerabilities — it is a list of risk categories, ranked from real data across hundreds of thousands of applications. That is why A01 "Broken Access Control" tops it rather than "SQL injection": access control is a class of bug, not a bug.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…