CWE

Informational

Common Weakness Enumeration

Definition

CWE (Common Weakness Enumeration) is a community catalog of software and hardware weaknesses organized by category. Unlike CVE, which identifies specific vulnerabilities, CWE classifies the types of weaknesses (for example, CWE-79 for XSS, CWE-89 for SQLi). It is maintained by MITRE and serves as the standard taxonomy for categorizing vulnerabilities.

Impact

Standardized classification of vulnerability typesAnalysis of software weakness trendsImproving secure development processesReference in SAST/DAST tools and scannersRequirement in high-quality bug bounty reports

Examples

Most common CWEs in bug bounty

The most reported CWEs in bug bounty programs include: CWE-79 (XSS), CWE-89 (SQL Injection), CWE-639 (IDOR), CWE-352 (CSRF), CWE-918 (SSRF), CWE-22 (Path Traversal), CWE-78 (OS Command Injection). Knowing the matching CWE improves the quality of the report.

External references

CWE - Full list CWE Top 25 Most Dangerous Software Weaknesses

Related terms

CVE

Common Vulnerabilities and Exposures

CVSS

Common Vulnerability Scoring System

OWASP Top 10

Responsible Disclosure

Bug Bounty

Practice CWE with real labs

Apply what you've learned in safe environments based on real bug bounty reports.

See practice labs

hunters training: 712
labs from real reports: 55
completions: 1,206
in bounties practiced: $213,970

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime