Skip to content
OpenAdvisories

Weakness (CWE)

CWE-433: Unparsed Raw Web Content Delivery

Variant Incomplete

The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

More detail

If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Perform a type check before interpreting files.

  2. Architecture and Design

    Do not store sensitive information in files which may be misinterpreted.

Source: MITRE CWE-433

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-31841

    Raw exposure of database statements in Hyperterse MCP search tool

    Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL que…

    hyperterse hyperterse hyperterse npm