CWE-96: Static Code Injection
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
Also known as Improper Neutralization of Directives in Statically Saved Code.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- storybookjs storybook Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites 8.6 High
- koozali sme server Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service 6.9 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 more Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog… 7.2 High
- webpros plesk extension "node.js toolkit", plesk extension "ruby" +1 more Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0... 8.7 High
- n-able n-central pre-authentication remote code execution 10.0 Critical
- qnap file station, qnap systems inc. file station 5 +1 more File Station 5 1.1 Low
- wpt00ls schema plugin for divi, gutenberg & shortcodes Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation 6.3 Medium
- dell unisphere for powermax vapp, solutions enabler virtual appliance, unisphere for powermax virtual appliance +2 more Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of... 7.2 High
- usermin Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code... 9.9 Critical
- tiny moxiemanager php In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command.... 9.4 Critical
- drupal opigno Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032 6.8 Medium
- drupal opigno tincan question type, opigno tincan question type +1 more Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031 7.5 High
- xwiki, xwiki xwiki-platform +1 more XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList 10.0 Critical
- xwiki, xwiki xwiki-platform +1 more XWiki allows remote code execution through the extension sheet 10.0 Critical
- xwiki, xwiki xwiki-platform +1 more XWiki Platform allows XSS through XClass name in string properties 9.1 Critical
- drupal opigno learning path, opigno learning path +1 more Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029 7.5 High
- drupal opigno module, opigno module +1 more Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028 9.8 Critical
- drupal opigno group manager, opigno group manager +1 more Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027 5.5 Medium
- xwiki, xwiki xwiki-platform +1 more XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader 6.4 Medium
- greenwoodsoftware less, debian linux, netapp bootstrap os +2 more +4 more less through 653 allows OS command execution via a newline character in the name of a file,... 8.6 High
- realdefen superantispyware, superantispyware pro x +1 more SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulation 6.6 Medium
- mintty project mintty An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via... 9.8 Critical
- hitachi vantara pentaho business analytics server, hitachi vantara pentaho business analytics server +1 more Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') 6.3 Medium
- hitachi vantara pentaho business analytics server, hitachi vantara pentaho business analytics server +1 more Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') 8.8 High
- froxlor, froxlor froxlor/froxlor +1 more Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor 6.2 Medium
- codingjoe django-s3file Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file 9.1 Critical
- microweber, microweber microweber/microweber +1 more Static Code Injection in microweber/microweber 7.7 High
- aviatrix controller An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a... 9.8 Critical
- atlassian jira service management, jira service desk data center, jira service desk server +1 more +3 more Affected versions of Atlassian Jira Service Management Server and Data Center allow remote... 7.2 High
- os4ed opensis A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.... 10.0 Critical
- os4ed opensis A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.... 10.0 Critical
- verizon serialize-javascript Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS) 4.2 Medium