Web application breaches sound, from the outside, like they must involve some sophisticated, cutting-edge attack technique. In the overwhelming majority of real cases, they don't. The Open Web Application Security Project publishes a regularly updated list, the OWASP Top 10, cataloguing the handful of vulnerability categories that account for most real-world web application security incidents — and the list has stayed remarkably consistent in its broad themes across multiple revisions, because the underlying mistakes are fundamental and keep getting made.
Broken access control: checking who's asking, not just what they're asking for
Broken access control consistently ranks among the most common and most damaging categories in the OWASP list. It covers any situation where an application fails to properly verify that the specific user making a request is actually authorised to access the specific resource or perform the specific action being requested — for instance, an application that lets a logged-in user view their own account by requesting a URL containing an account ID, but that fails to check whether the account ID in the URL actually belongs to the user making the request, letting anyone simply change the ID in the URL and view someone else's data. The vulnerability isn't a failure of authentication, confirming who someone is; it's a failure of authorization, confirming what that specific, correctly-identified person is actually allowed to do.
Injection: letting user input be interpreted as instructions
Injection flaws occur when an application takes data supplied by a user and passes it into a command interpreter, most commonly a database query, without properly separating that data from the structure of the command itself. A classic SQL injection attack exploits this by supplying input deliberately crafted to be interpreted as part of the database query's actual structure, rather than as a plain piece of data being searched for — potentially letting an attacker retrieve, modify, or delete data far beyond what the application was ever supposed to expose to them. The underlying fix, using parameterised queries that keep user-supplied data strictly separated from command structure regardless of what that data contains, has been well understood and readily available for a long time, which is part of why injection's persistent presence near the top of the list reflects a failure to consistently apply a known fix, more than a lack of a known solution.
What we're still unsure about
The OWASP Top 10's specific categories are based on extensive, well-documented aggregated data from real security incidents and are broadly trusted across the security industry as an accurate reflection of what actually goes wrong most often. What shifts more, and generates more genuine debate, is the relative ranking and precise scope of categories between the list's periodic revisions, since the underlying data sources, methodology, and the evolving landscape of what applications look like all change over time — security researchers generally agree on the broad recurring themes but don't treat the exact ranked order in any given revision as a permanently fixed hierarchy of risk.
This sits inside Web Application Security (OWASP Top 10), one of seven topics in Cybersecurity, one of seven domains in Computer Science, one of seventeen subjects the app can quiz you on.