Talk:Top 10 2007-Failure to Restrict URL Access
From OWASP
I think this may need changing: "All web application frameworks are vulnerable to failure to restrict URL access." to: "All web applications are potentially vulnerable to failure to restrict URL access."