Weakness class · CMDI
Command and Code Injection
17,245 published CVEs name a weakness in this class; 240 of them are exploited in the wild.
CWEs in this class11
| CWE | Weakness | CVEs | Exploited | Check |
|---|---|---|---|---|
| CWE-78 | OS Command Injection | 6,927 | 116 | 139 |
| CWE-94 | Code Injection | 5,818 | 71 | 115 |
| CWE-77 | Command Injection | 3,181 | 33 | 38 |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command | 470 | 4 | 4 |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | 279 | 3 | 7 |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code | 218 | 4 | 7 |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement | 187 | 6 | 4 |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code | 126 | 2 | 2 |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code | 29 | 1 | 0 |
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | 6 | 0 | 0 |
| CWE-624 | Executable Regular Expression Error | 4 | 0 | 0 |
Exploited and check counts are given for the class's largest CWEs; open a CWE for its CVEs.
Data as of 2026-11-14.