Skip to content
BackEsc
Sign in

CWE-96 · weakness in Command and Code Injection

Improper Neutralization of Directives in Statically Saved Code

29 CVEs · 1 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
likely to be exploited
2

Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code ExecutionCVE-2026-86218N-able · CVSS 10 · 15% likelycovered by CyberSIXT

    N-able11 articles1 article this week: Researcher Publishes PoC Exploits for 33 N-able N-central Flaws

  2. Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')CVE-2022-43938Hitachi Vantara · CVSS 8.8 · 26% likely

    Hitachi Vantara

  3. XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploaderCVE-2024-37900xwiki · CVSS 6.4 · 16% likely

    Xwiki

  4. A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for inje…CVE-2020-6144OS4Ed · CVSS 10 · 6.2% likely
  5. A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for inje…CVE-2020-6143OS4Ed · CVSS 10 · 6.2% likely
  6. A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker…CVE-2020-15180mariadb · 5.3% likely
  7. Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitr…CVE-2021-39115Atlassian · CVSS 7.2 · 4.5% likely

    Atlassian

  8. Static Code Injection in microweber/microweberCVE-2022-0895microweber · CVSS 7.7 · 1.7% likely

    Microweber

  9. XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosListCVE-2024-55877xwiki · CVSS 10 · 1.6% likely

    Xwiki

  10. Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.CVE-2015-2079Usermin · CVSS 9.9 · 1.6% likely
  11. An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.CVE-2023-39726Mintty Project · 1.2% likely
  12. Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the…CVE-2026-85475Red Hat · CVSS 7.2 · 0.8% likely

    Red Hat

  13. In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrar…CVE-2025-30091Tiny · CVSS 9.4 · 0.8% likely
  14. XWiki allows remote code execution through the extension sheetCVE-2024-55662xwiki · CVSS 10 · 0.8% likely

    Xwiki

  15. File Station 5CVE-2025-57707QNAP Systems Inc. · CVSS 1.1 · 0.7% likely

    QNAP

  16. Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom env…CVE-2026-68489WebPros · CVSS 8.7 · 0.7% likely

    WebPros

  17. Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high…CVE-2025-36595Dell · CVSS 7.2 · 0.7% likely

    Dell

  18. less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with a…CVE-2024-32487Greenwoodsoftware · CVSS 8.6 · 0.6% likely
  19. Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031CVE-2024-13267Drupal · CVSS 7.5 · 0.6% likely

    Drupal

  20. Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029CVE-2024-13265Drupal · CVSS 7.5 · 0.6% likely

    Drupal

  21. XWiki Platform allows XSS through XClass name in string propertiesCVE-2024-43400xwiki · CVSS 9.1 · 0.5% likely

    Xwiki

  22. Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032CVE-2024-13268Drupal · CVSS 6.8 · 0.5% likely

    Drupal

  23. Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028CVE-2024-13264Drupal · CVSS 9.8 · 0.5% likely

    Drupal

  24. Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')CVE-2022-3960Hitachi Vantara · CVSS 6.3 · 0.5% likely

    Hitachi Vantara

  25. Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of ServiceCVE-2026-108121Koozali · CVSS 6.9 · 0.3% likely
  26. Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object InstantiationCVE-2025-7825wpt00ls · CVSS 6.3 · 0.3% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in