Weakness (CWE)
CWE-96: Improper Neutralization of Directives in Statically Saved Code
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Implementation
Perform proper output validation and escaping to neutralize all code syntax from data written to code files.
Source: MITRE CWE-96
10 results · Clear filters · Feed
-
Critical 10.0
pre-authentication remote code execution
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
KEV Sep 8, 2026 -
Critical 9.9
Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the …
-
Critical 9.4
In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability all…
-
Critical 9.8
Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
-
Critical 10.0
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This co…
-
Critical 10.0
XWiki allows remote code execution through the extension sheet
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the se…
-
Critical 9.1CVE-2024-43400 Public exploit
XWiki Platform allows XSS through XClass name in string properties
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer …
-
Critical 9.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file
django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limit…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable w…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable w…