Cyber Resilience

CWE · MITRE source

CWE-140Improper Neutralization of Delimiters

Abstraction: Base · CVEs in our corpus: 20

The product does not neutralize or incorrectly neutralizes delimiters.

Last updated: 04 July 2026 12:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 2 framework(s): ATT&CK 2 (partial) · CAPEC 1 (partial)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1190 Exploit Public-Facing Application←P →MT1659 Content Injection←P →F

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-312085.58.30.00972023-05-17
CVE-2023-384885.57.10.00802023-07-27
CVE-2023-61565.57.60.00862023-11-22
CVE-2023-61575.57.60.00862023-11-22
CVE-2024-388655.58.80.00712025-04-10
CVE-2025-47779 UPD5.57.70.00422025-05-22
CVE-2024-38866 UPD5.57.50.00322025-05-27
CVE-2025-32918 UPD5.58.80.00332025-07-04
CVE-2026-334565.57.60.00202026-04-10
CVE-2026-6322 UPD5.57.50.00472026-05-05
CVE-2026-47162 UPD5.58.80.00222026-06-11
CVE-2024-65423.56.50.00472024-07-22
CVE-2024-424823.54.80.00822024-08-12
CVE-2024-423853.54.00.00092024-11-18
CVE-2024-423923.54.00.00212024-11-18
CVE-2025-48879 UPD3.56.50.00222025-06-10
CVE-2025-52989 UPD3.55.10.00122025-07-11
CVE-2026-216913.55.40.00242026-01-07
CVE-2026-334553.56.30.00182026-04-10
CVE-2026-334573.56.30.00182026-04-10