CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-96 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-5c6j-r48x-rmvq | - | HIGH |
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() |
2026-03-02 | |
| GHSA-2r87-74cx-2p7c | CVE-2024-55877 | CRITICAL |
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList |
2024-12-12 | |
| GHSA-j2pq-22jj-4pm5 | CVE-2024-55662 | CRITICAL |
XWiki allows remote code execution through the extension sheet |
2024-12-12 | |
| GHSA-wf3x-jccf-5g5g | CVE-2024-37900 | HIGH |
XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader |
2024-11-18 | |
| GHSA-4w8f-hjm9-xwgf | CVE-2022-24840 | CRITICAL |
Path Traversal in django-s3file |
2024-09-16 | |
| GHSA-wcg9-pgqv-xm5v | CVE-2024-43400 | CRITICAL |
XWiki Platform allows XSS through XClass name in string properties |
2024-08-19 | |
| GHSA-w7w4-qjgg-372x | CVE-2023-0566 | MODERATE | - |
Froxlor contains Static Code Injection |
2023-02-07 |
| GHSA-x28w-hvwc-mp75 | CVE-2022-0895 | HIGH | - |
Static Code Injection in Microweber |
2022-03-25 |