Cyber Resilience

CWE · MITRE source

CWE-76Improper Neutralization of Equivalent Special Elements

Abstraction: Base · CVEs in our corpus: 11

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous "-e" command-line switch when calling an external program, but it might not account for "--exec" or other switches that have the same semantics.

Last updated: 04 July 2026 11:13 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 6 mapping(s) from 2 framework(s): ATT&CK 5 (partial) · OWASP-Web 1 (full)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: other covers this; this covers other (F/M/P = full / mostly / partial).

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-1883 UPD8.06.30.61472024-03-14
CVE-2024-29527.09.80.01262024-04-10
CVE-2024-343597.09.60.28422024-05-14
CVE-2026-28292 UPD7.09.80.01302026-03-10
CVE-2024-1882 UPD5.57.20.01412024-03-14
CVE-2024-48975.58.40.00452024-07-02
CVE-2026-11311 UPD5.58.10.00572026-06-17
CVE-2023-04933.55.30.07902023-01-26
CVE-2023-11493.55.40.00552023-03-02
CVE-2024-21600 UPD3.56.50.00322024-01-12
CVE-2024-1221 UPD1.53.10.00552024-03-14