Cyber Resilience

CWE · MITRE source

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Abstraction: Class · CVEs in our corpus: 5,148

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Last updated: 22 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 30 mapping(s) from 2 framework(s): CAPEC 29 (partial) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SA-11 Developer Testing and Evaluation
  • SI-4 System Monitoring
  • PR.PS-06
  • SI-10 Information Input Validation
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.1
  • V1.2.3
  • V1.2.5
  • V1.2.8

NIST 800-53 r5 controls that address this weakness (2)AI-assisted

Control Title Family Why it addresses this CWE
SA-11Developer Testing and EvaluationSADeveloper assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
SI-4System MonitoringSIIdentifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1574.006 Dynamic Linker Hijacking←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2025-20281 KEV 10.010.00.97072025-06-25
CVE-2025-20337 KEV 10.010.00.66292025-07-16
CVE-2013-2251 KEV 9.99.81.00002013-07-20
CVE-2016-4010 9.99.80.92872017-01-23
CVE-2018-16763 9.99.80.82942018-09-09
CVE-2019-2725 KEV 9.99.80.99962019-04-26
CVE-2019-11581 KEV 9.99.80.84622019-08-09
CVE-2012-1495 9.99.80.79762020-01-27
CVE-2013-3214 9.99.80.84542020-01-28
CVE-2020-17496 KEV 9.99.80.87742020-08-12
CVE-2021-38294 9.99.80.84492021-10-25
CVE-2022-35914 KEV 9.99.80.99702022-09-19
CVE-2022-46169 KEV 9.99.80.99832022-12-05
CVE-2023-22527 KEV 9.99.80.99982024-01-16
CVE-2013-2010 9.89.80.73862020-02-12
CVE-2020-9757 9.89.80.72822020-03-04
CVE-2020-13942 9.89.80.68402020-11-24
CVE-2021-21242 9.810.00.74192021-01-15
CVE-2021-3197 9.89.80.72332021-02-27
CVE-2023-30547 9.89.80.72092023-04-17
CVE-2023-37462 9.69.90.91492023-07-14
CVE-2022-2992 9.59.90.86192022-10-17
CVE-2023-29524 9.59.90.75692023-04-19
CVE-2023-29525 9.59.90.77752023-04-19
CVE-2023-36469 9.59.90.82032023-06-29