OWASP 10 and SANS-CWE25 security analysis