Skip to content
OpenAdvisories

Weakness (CWE)

CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Variant Draft

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

Source: MITRE CWE-97

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.5
    CVE-2023-53934

    Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service

    A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through mal…

    Kentico Xperience
  • Medium 6.1
    CVE-2025-36558 EPSS 21%

    KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

    KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the u…

    KUNBUS Revolution Pi PiCtory
  • Critical 9.0
    CVE-2025-35996 EPSS 19%

    KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

    KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due …

    KUNBUS Revolution Pi PiCtory
  • High 7.8
    CVE-2025-21103

    Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an impro…

    Dell NetWorker Management Console
  • High 7.8
    CVE-2024-56363

    APTRS has SSTI vulnerability

    APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input…

    APTRS APTRS
  • High 7.2
    CVE-2024-37621

    StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /ship…

  • High 7.2
    CVE-2024-29686

    Winter CMS Server-Side Template Injection (SSTI) vulnerability

    Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be e…

    wintercms/winter Packagist