cve.bz

CWE-96: Improper Neutralization of Directives in Statically Saved Code (Static Code Injection)

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

What the weakness is: CWE-96 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 5
  • CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-96, as MITRE names them. Credits.

Ask an AI about CWE-96

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-96: Improper Neutralization of Directives in Statically Saved Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/96.html and https://cve.bz/cve/cwe/96?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2026-108121EPSS 0.3%

    Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration direc…

  2. 7.2CVE-2026-85475EPSS 0.8%

    A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LO…

  3. 8.7CVE-2026-68489EPSS 0.7%

    Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

  4. 10.0CVE-2026-86218KEVExploitEPSS 15%

    N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

  5. 1.1CVE-2025-57707EPSS 0.7%

    An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to acc…

  6. 6.3CVE-2025-7825EPSS 0.3%

    The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This…

  7. 7.2CVE-2025-36595EPSS 0.7%

    Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exp…

  8. 8.8CVE-2015-2079EPSS 1.6%

    Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.

  9. 9.4CVE-2025-30091EPSS 0.8%

    In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be in…

  10. 6.8CVE-2024-13268EPSS 0.5%

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.

  11. 7.5CVE-2024-13267EPSS 0.6%

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 befor…

  12. 7.5CVE-2024-13265EPSS 0.6%

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

  13. 9.8CVE-2024-13264EPSS 0.5%

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

  14. 5.5CVE-2024-13263EPSS 0.3%

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.

  15. 8.8CVE-2024-55877EPSS 1.6%

    XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` …

  16. 8.8CVE-2024-55662EPSS 0.8%

    XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programmi…

  17. 5.4CVE-2024-43400EPSS 0.5%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requi…

  18. 4.6CVE-2024-37900EPSS 16%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineerin…

  19. 8.6CVE-2024-32487EPSS 0.6%

    less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted f…

  20. 6.6CVE-2024-0788EPSS 0.2%

    SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver.

  21. 9.8CVE-2023-39726EPSS 1.2%

    An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.

  22. 8.8CVE-2022-43938EPSS 26%

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.

  23. 6.3CVE-2022-3960EPSS 0.5%

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.

  24. 9.8CVE-2022-0895EPSS 1.7%

    Static Code Injection in GitHub repository microweber/microweber prior to 1.3.

  25. 7.2CVE-2021-39115EPSS 4.5%

    Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vul…

  26. 9.8CVE-2020-6144EPSS 6.2%

    A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An …

  27. 9.8CVE-2020-6143EPSS 6.2%

    A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An …