Weakness (CWE)
CWE-96: Improper Neutralization of Directives in Statically Saved Code
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Implementation
Perform proper output validation and escaping to neutralize all code syntax from data written to code files.
Source: MITRE CWE-96
31 results · Feed
-
High 8.6
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…
-
Medium 6.9
Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting http…
-
High 7.2
Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOG…
-
High 8.7
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenti…
-
Critical 10.0
pre-authentication remote code execution
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
KEV Sep 8, 2026 -
High 8.1
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output witho…
-
Low 1.1
File Station 5
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data …
-
Medium 6.3
Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation
The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible f…
-
High 7.2
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically…
-
Critical 9.9
Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the …
-
Critical 9.4
In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability all…
-
Medium 6.8
Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
-
High 7.5
Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
-
High 7.5
Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
-
Critical 9.8
Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
-
Medium 5.5
Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
-
Critical 10.0
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This co…
-
Critical 10.0
XWiki allows remote code execution through the extension sheet
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the se…
-
Critical 9.1CVE-2024-43400 Public exploit
XWiki Platform allows XSS through XClass name in string properties
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer …
-
Medium 6.4CVE-2024-37900 EPSS 16%
XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the …
-
High 8.6
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandl…
-
Medium 6.6
SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulation
SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver.
-
Unscored —
An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the te…
-
Medium 6.3
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.
-
High 8.8CVE-2022-43938 EPSS 26%
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
-
Medium 6.2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
-
Critical 9.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file
django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limit…
-
High 7.7
Static Code Injection in microweber/microweber
Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
-
High 7.2CVE-2021-39115 Public exploit
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Adminis…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable w…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable w…