Cyber Resilience

CWE · MITRE source

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Abstraction: Class · CVEs in our corpus: 4,845

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 52 mapping(s) from 4 framework(s): CAPEC 32 (partial) · ATT&CK 11 (mostly) · ASVS 5.0 8 (full) · OWASP-Web 1 (full)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

NIST 800-53 r5 controls that address this weakness (2)AI

Control Title Family Why it addresses this CWE
SA-11Developer Testing and EvaluationSADeveloper assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
SI-4System MonitoringSIIdentifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1059 Command and Scripting Interpreter←P →MT1059.001 PowerShell←P →MT1059.003 Windows Command Shell←P →MT1059.004 Unix Shell←P →MT1190 Exploit Public-Facing Application←P →FT1203 Exploitation for Client Execution←P →PT1212 Exploitation for Credential Access←P →PT1221 Template Injection←P →FT1574.006 Dynamic Linker Hijacking←P →MT1659 Content Injection←P →FT1674 Input Injection←M →F

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2013-2251 KEV10.09.81.00002013-07-20
CVE-2019-2725 KEV10.09.80.99962019-04-26
CVE-2019-11581 KEV10.09.80.84622019-08-09
CVE-2019-17558 KEV10.07.50.98572019-12-30
CVE-2020-8468 KEV10.08.80.05752020-03-18
CVE-2020-17496 KEV10.09.80.87742020-08-12
CVE-2022-27924 KEV10.07.50.84592022-04-21
CVE-2022-35914 KEV10.09.80.99632022-09-19
CVE-2022-46169 KEV10.09.80.99832022-12-05
CVE-2022-43769 KEV10.08.80.97672023-04-03
CVE-2023-22527 KEV10.09.80.99982024-01-16
CVE-2025-20281 KEV UPD10.010.00.96732025-06-25
CVE-2025-20337 KEV UPD10.010.00.65102025-07-16
CVE-2014-84238.00.00.62482014-11-28
CVE-2015-15928.00.00.75032015-02-19
CVE-2016-40108.09.80.92872017-01-23
CVE-2018-10001308.08.10.73572018-03-14
CVE-2018-167638.09.80.82942018-09-09
CVE-2012-14958.09.80.79762020-01-27
CVE-2013-32148.09.80.84542020-01-28
CVE-2013-36288.08.80.67462020-02-07
CVE-2013-20108.09.80.73862020-02-12
CVE-2014-72368.09.10.55642020-02-17
CVE-2020-97578.09.80.73432020-03-04
CVE-2020-139428.09.80.68402020-11-24