CWE-20Improper Input Validation

Abstraction: Class · CVEs in our corpus: 12,993

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. Input can consist of: Data can be simple or structured. Structured data can be composed of many nested layers, composed of combinations of metadata and raw data, with other simple or structured data. Many properties of raw data or metadata may need to be validated upon entry into the code, such as: Implied or derived properties of data must often be calculated or inferred by the code itself. Errors in deriving properties may be considered a contributing factor to improper input validation.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 52 mapping(s) from 3 framework(s): CAPEC 50 (partial) · STIG rhel 8 1 (partial) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SI-10 Information Input Validation
SI-8 Spam Protection
PM-14 Testing, Training, and Monitoring
SA-11 Developer Testing and Evaluation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

6 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SI-10`	Information Input Validation	SI	Directly implements checks on information inputs to reject invalid data before processing.
`SI-8`	Spam Protection	SI	Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.
`PM-14`	Testing, Training, and Monitoring	PM	Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
`SA-11`	Developer Testing and Evaluation	SA	Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1036.001 Invalid Code Signature←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-11708` KEV	10.0	10.0	0.5587	2019-07-23
`CVE-2020-1350` KEV	10.0	10.0	0.9135	2020-07-14
`CVE-2021-44228` KEV	10.0	10.0	1.0000	2021-12-10
`CVE-2024-3400` KEV	10.0	10.0	1.0000	2024-04-12
`CVE-2025-20393` KEV	10.0	10.0	0.2988	2025-12-17
`CVE-2026-34910` KEV	10.0	10.0	0.8696	2026-05-22
`CVE-2016-3087`	9.9	9.8	0.8187	2016-06-07
`CVE-2016-5674`	9.9	9.8	0.9461	2016-08-31
`CVE-2016-8869`	9.9	9.8	0.9724	2016-11-04
`CVE-2016-6603`	9.9	9.8	0.8704	2017-01-23
`CVE-2016-10176`	9.9	9.8	0.7758	2017-01-30
`CVE-2017-3881` KEV	9.9	9.8	0.9898	2017-03-17
`CVE-2017-9791` KEV	9.9	9.8	0.9891	2017-07-10
`CVE-2017-12611`	9.9	9.8	0.8712	2017-09-20
`CVE-2017-12240` KEV	9.9	9.8	0.1388	2017-09-29
`CVE-2017-15944` KEV	9.9	9.8	0.9830	2017-12-11
`CVE-2017-8046`	9.9	9.8	0.7453	2018-01-04
`CVE-2018-5955`	9.9	9.8	0.8098	2018-01-21
`CVE-2018-0125` KEV	9.9	9.8	0.5519	2018-02-08
`CVE-2017-5816`	9.9	9.8	0.8620	2018-02-15
`CVE-2017-5817`	9.9	9.8	0.8259	2018-02-15
`CVE-2018-0147` KEV	9.9	9.8	0.1821	2018-03-08
`CVE-2018-0171` KEV	9.9	9.8	0.9949	2018-03-28
`CVE-2018-7600` KEV	9.9	9.8	1.0000	2018-03-29
`CVE-2019-0604` KEV	9.9	9.8	0.9982	2019-03-05