thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Common Weakness Enumeration (CWE)

A community-developed catalog of software and hardware weakness types, maintained by MITRE.

Definition

CWE provides identifiers for categories of flaws, such as CWE-79 for cross-site scripting or CWE-89 for SQL injection, regardless of the product affected. SAST tools and secure coding standards map findings to CWE IDs. MITRE publishes an annual CWE Top 25 Most Dangerous Software Weaknesses list.

Example

A SAST tool reports a finding as CWE-78: OS Command Injection.

Exam tip

CWE is a weakness class, not an instance; a CVE in a product usually maps to one or more CWEs.

Don't confuse it with

Related terms