Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (3.0)  

CWE CATEGORY: Validate Inputs

Category ID: 1019
Status: Draft
+ Summary
Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
+ Membership
MemberOfViewView1008Architectural Concepts
HasMemberClassClass20Improper Input Validation
HasMemberBaseBase59Improper Link Resolution Before File Access ('Link Following')
HasMemberClassClass74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
HasMemberClassClass75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
HasMemberBaseBase76Improper Neutralization of Equivalent Special Elements
HasMemberClassClass77Improper Neutralization of Special Elements used in a Command ('Command Injection')
HasMemberBaseBase78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
HasMemberBaseBase79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
HasMemberBaseBase88Argument Injection or Modification
HasMemberBaseBase89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
HasMemberBaseBase90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
HasMemberBaseBase91XML Injection (aka Blind XPath Injection)
HasMemberBaseBase93Improper Neutralization of CRLF Sequences ('CRLF Injection')
HasMemberClassClass94Improper Control of Generation of Code ('Code Injection')
HasMemberBaseBase95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
HasMemberBaseBase96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
HasMemberVariantVariant97Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
HasMemberBaseBase98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
HasMemberBaseBase99Improper Control of Resource Identifiers ('Resource Injection')
HasMemberClassClass138Improper Neutralization of Special Elements
HasMemberVariantVariant150Improper Neutralization of Escape, Meta, or Control Sequences
HasMemberBaseBase349Acceptance of Extraneous Untrusted Data With Trusted Data
HasMemberCompositeComposite352Cross-Site Request Forgery (CSRF)
HasMemberBaseBase472External Control of Assumed-Immutable Web Parameter
HasMemberVariantVariant473PHP External Variable Modification
HasMemberVariantVariant502Deserialization of Untrusted Data
HasMemberVariantVariant601URL Redirection to Untrusted Site ('Open Redirect')
HasMemberBaseBase641Improper Restriction of Names for Files and Other Resources
HasMemberBaseBase643Improper Neutralization of Data within XPath Expressions ('XPath Injection')
HasMemberBaseBase652Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
HasMemberClassClass790Improper Filtering of Special Elements
HasMemberBaseBase791Incomplete Filtering of Special Elements
HasMemberVariantVariant792Incomplete Filtering of One or More Instances of Special Elements
HasMemberVariantVariant793Only Filtering One Instance of a Special Element
HasMemberVariantVariant794Incomplete Filtering of Multiple Instances of Special Elements
HasMemberBaseBase795Only Filtering Special Elements at a Specified Location
HasMemberVariantVariant796Only Filtering Special Elements Relative to a Marker
HasMemberVariantVariant797Only Filtering Special Elements at an Absolute Position
HasMemberClassClass943Improper Neutralization of Special Elements in Data Query Logic
+ References
[REF-9] Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <>.
[REF-10] Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.". pages 69 - 78. 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <>.
+ Content History
Modification DateModifierOrganization
2017-07-25CWE Content TeamMITRE
New Entry

More information is available — Please select a different filter.
Page Last Updated: January 18, 2018