Scanner reports often tag findings with CWE IDs. The common ones for web apps are CWE-79 for cross-site scripting, CWE-89 for SQL injection, CWE-78 for OS command injection, CWE-502 for deserialization, CWE-352 for CSRF, CWE-287 for improper authentication and CWE-384 for session fixation.
What a CWE is
CWE stands for Common Weakness Enumeration. It is a catalog of types of software weakness, maintained by MITRE. A CWE names the kind of mistake, such as building a query from user input. A CVE, by contrast, identifies one specific flaw in one specific product. A scanner finding in your own code usually maps to a CWE, while a flaw in a library maps to a CVE that itself points to one or more CWEs.
The lookup table
All titles below come from the MITRE CWE pages.
| CWE | Official name | Typical scanner wording |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) | Reflected, stored or DOM XSS |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) | SQL injection, blind SQL injection |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) | Command injection |
| CWE-502 | Deserialization of Untrusted Data | Insecure deserialization |
| CWE-611 | Improper Restriction of XML External Entity Reference | XXE |
| CWE-918 | Server-Side Request Forgery (SSRF) | SSRF |
| CWE-601 | URL Redirection to Untrusted Site (Open Redirect) | Open redirect |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Missing anti-CSRF protection |
| CWE-287 | Improper Authentication | Authentication bypass, broken authentication |
| CWE-384 | Session Fixation | Session ID not renewed at login |
| CWE-613 | Insufficient Session Expiration | Long or missing session timeout |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | No lockout or throttling |
| CWE-521 | Weak Password Requirements | Weak password policy |
| CWE-209 | Generation of Error Message Containing Sensitive Information | Verbose errors, stack traces |
How to use CWE IDs in triage
- Group by CWE. If forty findings share CWE-79, you probably have one missing output encoding pattern, not forty bugs. Fix the shared pattern.
- Deduplicate across tools. A static scan and a dynamic scan may report the same issue with different names. The CWE is a stable key to match them. See dedupe SAST and DAST findings with CWE.
- Pick the fix from the weakness, not the tool. CWE-89 points to parameterization. CWE-384 points to renewing the ID at login. CWE-209 points to a generic error handler.
- Track by class over time. If one class keeps returning, the gap is in a shared library, code review checklist or training, not in individual code.
- Map to the OWASP Top 10. OWASP's A05:2025 Injection category covers 37 CWEs and includes cross-site scripting and SQL injection. The A07:2025 Authentication Failures entry lists CWE-384 session fixation among its mapped weaknesses. Using both lets you answer a customer who asks about the Top 10.
What a CWE does not tell you
A CWE does not tell you severity in your environment, whether the code is reachable, or whether a fix exists. Two findings with the same CWE can differ widely in risk, for example XSS on a public page versus XSS in a rarely used admin page. OWASP itself notes that the very large number of cross-site scripting CVEs, more than 30,000 in its data, lowers the average impact score of the whole injection category, while SQL injection with more than 14,000 CVEs is lower in frequency but higher in impact. Use the CWE to classify, and other signals to prioritize.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how findings are grouped and sorted, and which fields help you decide what to fix first.
Quick check
Is a CWE the same as a CVE?
No. A CWE is a class of weakness. A CVE is a specific vulnerability in a specific product, and it may reference a CWE.
Can one finding have more than one CWE?
Yes. Tools sometimes list a primary CWE and related ones. Pick the one that matches the fix you will make.
Safeguard's compliance and evidence automation and its free scan at gold.safeguard.sh/scan help you keep findings, fixes and records in one place.
Sources
- MITRE CWE-79, CWE-89, CWE-78, CWE-502
- MITRE CWE-611, CWE-918, CWE-601, CWE-352
- MITRE CWE-287, CWE-384, CWE-613, CWE-307, CWE-521, CWE-209
- OWASP Top 10 2025: A05 Injection
- OWASP Top 10 2025: A07 Authentication Failures
Last reviewed: 19 October 2026.
