Web applications provide access to increasing amounts of information, some of which is confidential. From an application perspective, vulnerability identification is absolutely critical and often over looked as a source of risk. The outlines of this paper is to classify the attacks and weaknesses that can lead to the compromise of a website, its data, or its users In this paper web application vulnerabilities are classified on the basis of requirement analysis, design, implementation and deployment of web application.