Common Weakness Enumeration

    CWE Definition / CWE-184

    CWE-184: Incomplete List of Disallowed Inputs

    The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-693: Protection Mechanism Failure

    CWE-1023: Incomplete Comparison with Missing Factors

    CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    CWE-434: Unrestricted Upload of File with Dangerous Type

    CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')