Common Weakness Enumeration

    CWE Definition / CWE-20

    CWE-20: Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:30 Apr 2026

    Related Weakness

    CWE-707: Improper Neutralization

    CWE-345: Insufficient Verification of Data Authenticity

    CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    CWE-41: Improper Resolution of Path Equivalence

    CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CWE-770: Allocation of Resources Without Limits or Throttling