CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Abstraction: Base · CVEs in our corpus: 78

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 1 mapping(s) from 1 framework(s): CAPEC 1 (full)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SI-10 Information Input Validation
SA-8 Security and Privacy Engineering Principles

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.2.6

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2016-9299`	9.9	9.8	0.9694	2017-01-12
`CVE-2017-14596`	8.0	9.8	0.0688	2017-09-20
`CVE-2021-43350`	7.9	9.8	0.0443	2021-11-11
`CVE-2017-8790`	7.6	9.8	0.0137	2017-05-05
`CVE-2011-4069`	7.6	9.8	0.0155	2018-02-01
`CVE-2024-33868`	7.5	9.8	0.0090	2024-05-14
`CVE-2024-54852`	7.4	9.8	0.0076	2025-01-29
`CVE-2026-25560`	7.4	9.8	0.0065	2026-02-07
`CVE-2026-44930`	7.4	9.8	0.0069	2026-05-22
`CVE-2026-41919`	6.9	9.1	0.0045	2026-05-19
`CVE-2026-49268`	6.9	9.1	0.0049	2026-06-17
`CVE-2022-4254`	6.7	8.8	0.0095	2023-02-01
`CVE-2026-39962`	6.7	9.6	0.0034	2026-04-09
`CVE-2026-47303`	6.7	8.8	0.0074	2026-07-14
`CVE-2026-58222`	6.7	8.8	0.0084	2026-07-30
`CVE-2025-48208`	6.6	8.8	0.0063	2025-09-09
`CVE-2026-33289`	6.6	8.8	0.0066	2026-03-20
`CVE-2026-40459`	6.6	8.8	0.0061	2026-04-17
`CVE-2026-31828`	6.5	8.8	0.0042	2026-03-10
`CVE-2026-13696`	6.5	8.8	0.0036	2026-07-07
`CVE-2019-11277`	6.4	8.1	0.0171	2019-09-23
`CVE-2017-4927`	6.3	7.5	0.0232	2017-11-17
`CVE-2015-7294`	6.2	7.5	0.0212	2017-09-06
`CVE-2026-34578`	6.2	8.2	0.0042	2026-04-09
`CVE-2026-40193`	6.2	8.2	0.0042	2026-04-16