Cyber Posture

CWE · MITRE source

CWE-20Improper Input Validation

Abstraction: Class · CVEs in our corpus: 12,096

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. Input can consist of: Data can be simple or structured. Structured data can be composed of many nested layers, composed of combinations of metadata and raw data, with other simple or structured data. Many properties of raw data or metadata may need to be validated upon entry into the code, such as: Implied or derived properties of data must often be calculated or inferred by the code itself. Errors in deriving properties may be considered a contributing factor to improper input validation.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (4)AI

Control Title Family Why it addresses this CWE
SI-10Information Input ValidationSIDirectly implements checks on information inputs to reject invalid data before processing.
SI-8Spam ProtectionSISpam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.
PM-14Testing, Training, and MonitoringPMSecurity testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
SA-11Developer Testing and EvaluationSASecurity testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-44228 KEV9.710.00.94462021-12-10
CVE-2024-3400 KEV9.710.00.94322024-04-12
CVE-2017-3881 KEV9.69.80.94282017-03-17
CVE-2017-9791 KEV9.69.80.94082017-07-10
CVE-2017-15944 KEV9.69.80.93912017-12-11
CVE-2018-7600 KEV9.69.80.94492018-03-29
CVE-2019-0604 KEV9.69.80.94442019-03-05
CVE-2020-1350 KEV9.610.00.93822020-07-14
CVE-2021-21985 KEV9.69.80.94412021-05-26
CVE-2022-24086 KEV9.69.80.93742022-02-16
CVE-2022-47966 KEV9.69.80.94382023-01-18
CVE-2023-23397 KEV9.69.80.93402023-03-14
CVE-2023-22515 KEV9.69.80.94332023-10-04
CVE-2018-0171 KEV9.59.80.92672018-03-28
CVE-2024-21413 KEV9.59.80.92962024-02-13
CVE-2009-0927 KEV9.48.80.93312009-03-19
CVE-2016-3714 KEV9.38.40.93752016-05-05
CVE-2017-0148 KEV9.38.10.94082017-03-17
CVE-2022-29499 KEV9.39.80.88622022-04-26
CVE-2023-22952 KEV9.38.80.92822023-01-11
CVE-2023-2868 KEV9.39.40.90802023-05-24
CVE-2018-0296 KEV9.27.50.94402018-06-07
CVE-2020-3161 KEV9.29.80.87092020-04-15
CVE-2020-3452 KEV9.27.50.94452020-07-22
CVE-2012-1535 KEV9.17.80.91612012-08-15