CWE REFERENCE
Common Weakness Enumeration (CWE)
The Common Weakness Enumeration (CWE) is a community-developed list of software and hardware weakness types maintained by MITRE Corporation and sponsored by the US Department of Homeland Security. Each CWE entry describes a specific category of flaw that can lead to vulnerabilities — it is not a specific bug instance, but a class of bug.
CodeScan maps every finding to a CWE ID so you understand the nature of the risk, not just its location. The table below covers every CWE that CodeScan can report, organised by category.
Official reference: cwe.mitre.org — search any CWE ID for the full specification, examples, and related weaknesses.
Injection
| CWE ID | Name | What it means |
|---|---|---|
| CWE-89 | SQL Injection | User-controlled input is concatenated into a SQL query without parameterisation, allowing an attacker to alter the query structure, bypass authentication, extract data, or destroy tables. |
| CWE-564 | SQL Injection via Hibernate | SQL injection through ORM query methods where native queries or Criteria API accept unsanitised parameters. |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | Injection into non-SQL query languages such as LDAP, XPath, NoSQL (MongoDB), or GraphQL. |
| CWE-79 | Cross-Site Scripting (XSS) | Unvalidated user data is written into HTML output or the DOM, letting an attacker inject scripts that execute in a victim's browser — stealing cookies, credentials, or performing actions on behalf of the user. |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | XSS that survives partial sanitisation by using alternative encodings or lesser-known event attributes. |
| CWE-78 | OS Command Injection | Unsanitised input is passed to a system shell function (system(), exec(), subprocess), letting an attacker run arbitrary OS commands with the server's privileges. |
| CWE-77 | Command Injection | Similar to CWE-78 but broader — covers injection into any interpreter, including SQL, LDAP, and OS shells. |
| CWE-94 | Code Injection | User input is evaluated as code (eval(), exec() in Python/JS, unserialize() in PHP), giving attackers arbitrary code execution. |
| CWE-917 | Server-Side Template Injection (SSTI) | User input is embedded in a template without sanitisation, letting an attacker execute expressions in the template engine context. |
| CWE-611 | Improper Restriction of XML External Entity (XXE) | An XML parser processes external entity references supplied by an attacker, leaking server files or enabling SSRF. |
| CWE-91 | XML Injection | User data is inserted into XML without encoding, allowing manipulation of XML structure or content. |
| CWE-1236 | Improper Neutralization of Formulas in CSV Files | Unsanitised data exported to CSV can contain formula injection that executes in spreadsheet applications. |
Authentication & Session Management
| CWE ID | Name | What it means |
|---|---|---|
| CWE-287 | Improper Authentication | Authentication logic can be bypassed — missing checks, trusting client-supplied identity, or logic errors that grant access without valid credentials. |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | No rate limiting or lockout on login endpoints, enabling brute-force password attacks. |
| CWE-308 | Use of Single-Factor Authentication | Only one factor is required; NIST recommends multi-factor for sensitive operations. |
| CWE-384 | Session Fixation | An application allows a session ID supplied by the attacker before authentication, letting the attacker hijack the session after login. |
| CWE-613 | Insufficient Session Expiration | Sessions remain valid for too long or are not invalidated on logout, increasing the window for token theft. |
| CWE-521 | Weak Password Requirements | No minimum length, complexity, or breach-detection policy allows trivially guessable passwords. |
| CWE-640 | Weak Password Recovery Mechanism | Password reset flows rely on predictable tokens, security questions, or email-only verification without rate limiting. |
| CWE-620 | Unverified Password Change | Password change does not require the current password, allowing account takeover if a session is stolen. |
| CWE-798 | Use of Hard-coded Credentials | Usernames or passwords are embedded in source code, configuration files, or container images and cannot be rotated without a code change. |
| CWE-259 | Use of Hard-coded Password | A specific sub-case of CWE-798 focused on passwords embedded in code. |
Cryptography
| CWE ID | Name | What it means |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | Deprecated algorithms (MD5, SHA-1, DES, RC4, 3DES) provide insufficient security and can be broken with modern hardware. |
| CWE-328 | Use of Weak Hash | Unsalted MD5 or SHA-1 hashes of passwords are trivially reversed with rainbow tables. |
| CWE-330 | Use of Insufficiently Random Values | Predictable random values (Math.random(), rand()) used in security contexts allow token forgery. |
| CWE-338 | Use of Cryptographically Weak PRNG | A non-cryptographic PRNG is used where cryptographic randomness is required (tokens, keys, IVs). |
| CWE-326 | Inadequate Encryption Strength | Key sizes below modern recommendations (RSA < 2048-bit, AES < 128-bit) can be brute-forced. |
| CWE-321 | Use of Hard-coded Cryptographic Key | Encryption keys embedded in source code cannot be rotated and are exposed in version control. |
| CWE-325 | Missing Required Cryptographic Step | Omitting key steps — initialisation vectors, salts, authentication tags — undermines security guarantees. |
| CWE-311 | Missing Encryption of Sensitive Data | Sensitive data (passwords, PII, tokens) stored or transmitted in plaintext. |
| CWE-312 | Cleartext Storage of Sensitive Information | Passwords, keys, or PII written to disk, logs, or databases without encryption. |
| CWE-319 | Cleartext Transmission of Sensitive Information | Sensitive data sent over HTTP, unencrypted sockets, or FTP instead of TLS. |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | Fast hashing algorithms (MD5, SHA-256 without PBKDF2/bcrypt/Argon2) allow rapid offline cracking. |
Access Control
| CWE ID | Name | What it means |
|---|---|---|
| CWE-284 | Improper Access Control | Resources are not correctly restricted by role or ownership — any authenticated (or even unauthenticated) user can access them. |
| CWE-285 | Improper Authorization | The system does not verify that an authenticated principal is authorised to perform the requested action. |
| CWE-862 | Missing Authorization | No access control check is performed before granting access to a sensitive function or resource. |
| CWE-863 | Incorrect Authorization | An authorisation check is present but evaluates the wrong condition, granting unintended access. |
| CWE-639 | Authorization Bypass Through User-Controlled Key | An object reference (ID) is user-supplied; the application fetches the object without verifying ownership — IDOR. |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | Files, directories, or system resources have permissions that are too broad (world-readable secrets, 0777 directories). |
| CWE-269 | Improper Privilege Management | Processes retain elevated privileges longer than needed, or privilege escalation is not properly restricted. |
| CWE-276 | Incorrect Default Permissions | Newly created files or resources default to permissions that grant unintended access to other users or processes. |
Path Traversal & File Handling
| CWE ID | Name | What it means |
|---|---|---|
| CWE-22 | Path Traversal (../ Sequences) | User-controlled input contains directory traversal sequences that escape the intended base path, exposing arbitrary files. |
| CWE-23 | Relative Path Traversal | A relative path is constructed from user input without normalisation, allowing traversal to parent directories. |
| CWE-36 | Absolute Path Traversal | An absolute path supplied by the user directly accesses files outside the intended scope. |
| CWE-73 | External Control of File Name or Path | Filenames or paths used in file operations are entirely controlled by user input. |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | File upload functionality does not restrict file types, allowing upload of executable scripts (webshells). |
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | Temp files created in world-writable directories can be replaced by a symlink attack. |
Sensitive Data Exposure & Logging
| CWE ID | Name | What it means |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Error messages, stack traces, or responses leak internal paths, versions, or credentials. |
| CWE-209 | Generation of Error Message Containing Sensitive Information | Exception handlers return full stack traces or database error messages to the client. |
| CWE-532 | Insertion of Sensitive Information into Log File | Passwords, tokens, or PII are written to log files that may be accessible to lower-privileged staff. |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | Personal data (SSN, medical records, financial info) accessible to parties not authorised to see it — GDPR risk. |
| CWE-214 | Invocation of Process Using Visible Sensitive Information | Passwords or secrets appear in process arguments visible via ps, /proc, or Task Manager. |
| CWE-540 | Inclusion of Sensitive Information in Source Code | API keys, database URLs, or internal hostnames committed to source control. |
Input Validation & Sanitisation
| CWE ID | Name | What it means |
|---|---|---|
| CWE-20 | Improper Input Validation | Input is accepted and used without sufficient validation — the root cause of a large proportion of all vulnerabilities. |
| CWE-116 | Improper Encoding or Escaping of Output | Output is not encoded for its destination context (HTML, URL, SQL, shell), enabling injection attacks. |
| CWE-176 | Improper Handling of Unicode Encoding | Multi-byte Unicode sequences bypass input validation or encoding, leading to injection or path traversal. |
| CWE-178 | Improper Handling of Case Sensitivity | Security decisions made on case-sensitive comparisons can be bypassed with alternate casing. |
| CWE-129 | Improper Validation of Array Index | Array indices from user input are not range-checked, enabling out-of-bounds reads or writes. |
| CWE-190 | Integer Overflow or Wraparound | Arithmetic on attacker-controlled integers wraps around, producing unexpected values used in buffer sizes or array indices. |
| CWE-191 | Integer Underflow (Wrap-around) | Subtraction of unsigned integers wraps to a very large value, used as a size argument causing memory issues. |
| CWE-400 | Uncontrolled Resource Consumption | Unrestricted input size, request rate, or recursive processing causes DoS by exhausting CPU, memory, or disk. |
| CWE-601 | Open Redirect | User-supplied URLs are used in redirect responses without validation, enabling phishing via trusted domain. |
Deserialization & Object Injection
| CWE ID | Name | What it means |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | Deserialising attacker-controlled data without type validation enables remote code execution via gadget chains. Java ObjectInputStream, Python pickle, PHP unserialize. |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Mass assignment — binding request parameters directly to object properties grants attackers control over sensitive fields. |
Security Misconfiguration
| CWE ID | Name | What it means |
|---|---|---|
| CWE-16 | Configuration | Broad category for insecure default configurations — debug mode in production, permissive CORS, missing security headers. |
| CWE-693 | Protection Mechanism Failure | A security control is present but misconfigured or bypassable — CSP with unsafe-inline, CSRF tokens not validated. |
| CWE-1004 | Sensitive Cookie Without HttpOnly Flag | Session cookies missing HttpOnly can be read by JavaScript, enabling token theft via XSS. |
| CWE-614 | Sensitive Cookie Without Secure Flag | Session cookies sent over HTTP in addition to HTTPS, enabling theft on mixed-content pages. |
| CWE-1008 | Weak Dependency or Build Process | Missing security checks in build pipeline (npm audit, dependency pinning) allow supply-chain vulnerabilities to reach production. |
| CWE-494 | Download of Code Without Integrity Check | Dependencies or plugins downloaded without hash or signature verification — open to supply-chain attacks. |
| CWE-1021 | Improper Restriction of Rendered UI Layers (Clickjacking) | Missing X-Frame-Options or CSP frame-ancestors header allows the page to be embedded in an attacker's iframe. |
| CWE-352 | Cross-Site Request Forgery (CSRF) | State-changing requests accepted without a CSRF token — attackers can forge requests from another origin. |
Server-Side Request Forgery & Network
| CWE ID | Name | What it means |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | The server fetches a URL supplied by the user, enabling attackers to reach internal services, cloud metadata endpoints (169.254.169.254), or localhost. |
| CWE-441 | Unintended Proxy or Intermediary (Confused Deputy) | The application performs actions on behalf of the requester without verifying the requester's authority to access the target resource. |
Memory Safety (C / C++)
| CWE ID | Name | What it means |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Parent class for buffer overflows; reading or writing beyond allocated memory boundaries. |
| CWE-120 | Buffer Copy without Checking Size of Input (Classic Buffer Overflow) | strcpy, gets, sprintf used without length checks allow stack/heap overflow. |
| CWE-125 | Out-of-bounds Read | Reading past the end of a buffer leaks adjacent memory contents, potentially exposing keys or pointers. |
| CWE-787 | Out-of-bounds Write | Writing past the end of a buffer corrupts adjacent memory — common root cause of exploitable vulnerabilities (CISA KEV frequent flyer). |
| CWE-416 | Use After Free | Memory is freed but a pointer to it remains in use; subsequent writes corrupt heap metadata and can lead to code execution. |
| CWE-476 | NULL Pointer Dereference | A NULL pointer is dereferenced without a prior null check, causing a crash (DoS) or, in some contexts, privilege escalation. |
| CWE-415 | Double Free | Freeing the same memory block twice corrupts heap metadata, often leading to exploitable conditions. |
| CWE-401 | Missing Release of Memory after Effective Lifetime (Memory Leak) | Memory is allocated but never freed, causing gradual resource exhaustion and eventual DoS. |
Concurrency & Race Conditions
| CWE ID | Name | What it means |
|---|---|---|
| CWE-362 | Race Condition (Concurrent Execution Using Shared Resource with Improper Synchronisation) | Two or more threads access shared state without proper locking; outcome depends on scheduling, enabling TOCTOU attacks or data corruption. |
| CWE-367 | TOCTOU (Time-of-check Time-of-use) | A security check (file permissions, balance) is performed at one time, but the resource is used at another — an attacker can change the resource in between. |
Software & Supply-Chain Integrity
| CWE ID | Name | What it means |
|---|---|---|
| CWE-494 | Download of Code Without Integrity Check | Third-party code fetched at build or runtime without signature/hash verification — open to supply-chain attacks. |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Loading scripts, plugins, or packages from untrusted CDNs or registries without integrity checks. |
| CWE-1104 | Use of Unmaintained Third-Party Components | Unmaintained dependencies no longer receive security patches, accumulating known exploits over time. |
| CWE-1035 | OWASP Top Ten 2017 A9: Using Components with Known Vulnerabilities | Direct reference to the OWASP category; dependency has a published CVE. |
Full CWE database
CodeScan detects over 80 distinct weakness classes. For the complete list of all 900+ CWE entries including mitigations, examples, and related CVEs, visit cwe.mitre.org/data/index.html. The authoritative CWE Top 25 Most Dangerous Software Weaknesses list is updated annually from NVD CVE data.