CWE-138: Improper Neutralization of Special Elements
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
13 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-5878 — ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element
- CVE-2026-55841 — Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
- CVE-2026-20009 — Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability
- CVE-2024-51500 — Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
- CVE-2025-48939 — tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
Recently published
- CVE-2026-55841 — Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
- CVE-2026-20009 — Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability
- CVE-2025-48939 — tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
- CVE-2025-5878 — ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element
- CVE-2024-51500 — Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
More specific weaknesses
- CWE-140 — Improper Neutralization of Delimiters
- CWE-147 — Improper Neutralization of Input Terminators
- CWE-148 — Improper Neutralization of Input Leaders
- CWE-149 — Improper Neutralization of Quoting Syntax
- CWE-150 — Improper Neutralization of Escape, Meta, or Control Sequences
- CWE-151 — Improper Neutralization of Comment Delimiters
- CWE-152 — Improper Neutralization of Macro Symbols
- CWE-153 — Improper Neutralization of Substitution Characters
- CWE-154 — Improper Neutralization of Variable Name Delimiters
- CWE-155 — Improper Neutralization of Wildcards or Matching Symbols
- CWE-156 — Improper Neutralization of Whitespace
- CWE-157 — Failure to Sanitize Paired Delimiters
- CWE-158 — Improper Neutralization of Null Byte or NUL Character
- CWE-159 — Improper Handling of Invalid Use of Special Elements
- CWE-160 — Improper Neutralization of Leading Special Elements
- CWE-162 — Improper Neutralization of Trailing Special Elements
- CWE-164 — Improper Neutralization of Internal Special Elements
- CWE-464 — Addition of Data Structure Sentinel
- CWE-790 — Improper Filtering of Special Elements