CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Filter
The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
What the weakness is: CWE-97 at MITRE. OWASP Top 10: A05:2025 Injection
Related attack patterns (CAPEC): 2
- CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
- CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-97, as MITRE names them. Credits.
Ask an AI about CWE-97
Show the prompt
Explain CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/97.html and https://cve.bz/cve/cwe/97?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.7CVE-2023-53934EPSS 0.4%
A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service avai…
- 5.1CVE-2025-36558EPSS 21%
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script…
- 8.5CVE-2025-35996EPSS 19%
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of confi…
- 7.8CVE-2025-21103EPSS 0.2%
Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization of server-side vulnerability. An unauthenticated attacker with local access could potentially exploit…
- 7.8CVE-2024-56363EPSS 0.3%
APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of…
- 7.2CVE-2024-37621EPSS 0.7%
StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.
- 7.2CVE-2024-29686EPSS 1.8%
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the pay…