Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-51 | Path Equivalence: '/multiple//internal/slash' | Weakness | Allowed | 0 |
| CWE-52 | Path Equivalence: '/multiple/trailing/slash//' | Weakness | Allowed | 0 |
| CWE-53 | Path Equivalence: '\multiple\\internal\backslash' | Weakness | Allowed | 0 |
| CWE-54 | Path Equivalence: 'filedir\' (Trailing Backslash) | Weakness | Allowed | 0 |
| CWE-55 | Path Equivalence: '/./' (Single Dot Directory) | Weakness | Allowed | 0 |
| CWE-56 | Path Equivalence: 'filedir*' (Wildcard) | Weakness | Allowed | 0 |
| CWE-57 | Path Equivalence: 'fakedir/../realdir/filename' | Weakness | Allowed | 0 |
| CWE-58 | Path Equivalence: Windows 8.3 Filename | Weakness | Allowed | 0 |
| CWE-59 | Improper Link Resolution Before File Access | Weakness | Allowed | 1938 |
| CWE-60 | DEPRECATED: UNIX Path Link Problems | Grouping | Prohibited | 0 |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | Weakness | Allowed | 267 |
| CWE-62 | UNIX Hard Link | Weakness | Allowed | 7 |
| CWE-63 | DEPRECATED: Windows Path Link Problems | Grouping | Prohibited | 0 |
| CWE-64 | Windows Shortcut Following (.LNK) | Weakness | Allowed | 22 |
| CWE-65 | Windows Hard Link | Weakness | Allowed | 8 |
| CWE-66 | Improper Handling of File Names that Identify Virtual Resources | Weakness | Allowed | 2 |
| CWE-67 | Improper Handling of Windows Device Names | Weakness | Allowed | 10 |
| CWE-68 | DEPRECATED: Windows Virtual File Problems | Grouping | Prohibited | 0 |
| CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | Weakness | Allowed | 4 |
| CWE-70 | DEPRECATED: Mac Virtual File Problems | Grouping | Prohibited | 0 |
| CWE-71 | DEPRECATED: Apple '.DS_Store' | Weakness | Prohibited | 0 |
| CWE-72 | Improper Handling of Apple HFS+ Alternate Data Stream Path | Weakness | Allowed | 0 |
| CWE-73 | External Control of File Name or Path | Weakness | Allowed | 879 |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component | Weakness | Discouraged | 9174 |
| CWE-75 | Failure to Sanitize Special Elements into a Different Plane | Weakness | Discouraged | 58 |
| CWE-76 | Improper Neutralization of Equivalent Special Elements | Weakness | Allowed | 20 |
| CWE-77 | Improper Neutralization of Special Elements used in a Command | Weakness | Allowed-with-Review | 5331 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command | Weakness | Allowed | 10214 |
| CWE-79 | Improper Neutralization of Input During Web Page Generation | Weakness | Allowed | 70376 |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Weakness | Allowed | 928 |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | Weakness | Allowed | 16 |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | Weakness | Allowed | 14 |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | Weakness | Allowed | 39 |
| CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | Weakness | Allowed | 25 |
| CWE-85 | Doubled Character XSS Manipulations | Weakness | Allowed | 3 |
| CWE-86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | Weakness | Allowed | 19 |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | Weakness | Allowed | 96 |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command | Weakness | Allowed | 951 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command | Weakness | Allowed | 27239 |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query | Weakness | Allowed | 112 |
| CWE-91 | XML Injection | Weakness | Allowed-with-Review | 189 |
| CWE-92 | DEPRECATED: Improper Sanitization of Custom Special Characters | Weakness | Prohibited | 34 |
| CWE-93 | Improper Neutralization of CRLF Sequences | Weakness | Allowed | 320 |
| CWE-94 | Improper Control of Generation of Code | Weakness | Allowed-with-Review | 8652 |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code | Weakness | Allowed | 260 |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code | Weakness | Allowed | 43 |
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | Weakness | Allowed | 11 |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program | Weakness | Allowed | 2439 |
| CWE-99 | Improper Control of Resource Identifiers | Weakness | Allowed-with-Review | 113 |
| CWE-100 | DEPRECATED: Technology-Specific Input Validation Problems | Grouping | Prohibited | 0 |