CWE-1027: OWASP Top Ten 2017 Category A1 - Injection

• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
• CWE-91: XML Injection (aka Blind XPath Injection)
• CWE-564: SQL Injection: Hibernate
• CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
• CWE-943: Improper Neutralization of Special Elements in Data Query Logic

• CVE-2021-27021
  High · CVSS 8.8 · EPSS 70th

  2021-07-20
• CVE-2025-59874

  HCL Hive Telco Observability is affected by a Required directives missing from the CSP .

  High · CVSS 8.1 · EPSS 19th

  2026-06-04

What is CWE-1027?

Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2017.

What CVEs are caused by CWE-1027?

2 recorded CVEs are attributed to CWE-1027, including CVE-2021-27021 and CVE-2025-59874.

Is CWE-1027 actively exploited?

2 recorded CVEs are caused by CWE-1027; none are currently in CISA's KEV catalog of actively exploited flaws.

1. [1]Top 10 2017 (2017)

• MITRE CWE definition (CWE-1027) (opens in a new tab)
• CWE-1027 vulnerabilities on NVD (opens in a new tab)
• Learn: What is a CWE?

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.