CWE-96 · Command and Code Injection
Improper Neutralization of Directives in Statically Saved Code
29CVEs
1exploited
0with a public check
2likely (EPSS 10%+)
SortMost likely exploited
29 CVEs with CWE-96 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-86218In CISA KEVExploitedN-able N-central <2026.3.1.14 - Pre-Authentication Remote Code ExecutionN-able · N-central · CVSS 10 · 2026-09-06 | 10.0 | 15% | 2026-09-06 |
| CVE-2022-43938Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')Hitachi Vantara · Pentaho Business Analytics Server · CVSS 8.8 · 2023-04-03 | 8.8 | 26% | 2023-04-03 |
| CVE-2024-37900XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploaderxwiki · xwiki-platform · CVSS 6.4 · 2024-07-31 | 6.4 | 16% | 2024-07-31 |
| CVE-2020-6144A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for inje…Os4ed · OS4Ed · CVSS 10 · 2020-09-01 | 10.0 | 6.2% | 2020-09-01 |
| CVE-2020-6143A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for inje…Os4ed · OS4Ed · CVSS 10 · 2020-09-01 | 10.0 | 6.2% | 2020-09-01 |
| CVE-2020-15180A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker…Mariadb · mariadb · 2021-05-27 | – | 5.3% | 2021-05-27 |
| CVE-2021-39115Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitr…Atlassian · Jira Service Desk Server · CVSS 7.2 · 2021-09-01 | 7.2 | 4.5% | 2021-09-01 |
| CVE-2022-0895Static Code Injection in microweber/microwebermicroweber · microweber/microweber · CVSS 7.7 · 2022-03-10 | 7.7 | 1.7% | 2022-03-10 |
| CVE-2024-55877XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosListxwiki · xwiki-platform · CVSS 10 · 2024-12-12 | 10.0 | 1.6% | 2024-12-12 |
| CVE-2015-2079Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.Usermin · Usermin · CVSS 9.9 · 2025-04-28 | 9.9 | 1.6% | 2025-04-28 |
| CVE-2023-39726An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.Mintty Project · Mintty · 2023-10-26 | – | 1.2% | 2023-10-26 |
| CVE-2026-85475Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the…Red Hat · Red Hat Ansible Automation Platform 2.7 · CVSS 7.2 · 2026-09-23 | 7.2 | 0.8% | 2026-09-23 |
| CVE-2025-30091In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrar…Tiny · MoxieManager PHP · CVSS 9.4 · 2025-03-25 | 9.4 | 0.8% | 2025-03-25 |
| CVE-2024-55662XWiki allows remote code execution through the extension sheetxwiki · xwiki-platform · CVSS 10 · 2024-12-12 | 10.0 | 0.8% | 2024-12-12 |
| CVE-2025-57707File Station 5QNAP Systems Inc. · File Station 5 · CVSS 1.1 · 2026-02-11 | 1.1 | 0.7% | 2026-02-11 |
| CVE-2026-68489Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom env…WebPros · Plesk extension "Ruby" · CVSS 8.7 · 2026-09-14 | 8.7 | 0.7% | 2026-09-14 |
| CVE-2025-36595Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high…Dell · Unisphere for PowerMax vApp · CVSS 7.2 · 2025-06-27 | 7.2 | 0.7% | 2025-06-27 |
| CVE-2024-32487less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with a…Greenwoodsoftware · Less · CVSS 8.6 · 2024-04-13 | 8.6 | 0.6% | 2024-04-13 |
| CVE-2024-13267Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031Drupal · Opigno TinCan Question Type · CVSS 7.5 · 2025-01-09 | 7.5 | 0.6% | 2025-01-09 |
| CVE-2024-13265Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029Drupal · Opigno Learning path · CVSS 7.5 · 2025-01-09 | 7.5 | 0.6% | 2025-01-09 |
| CVE-2024-43400XWiki Platform allows XSS through XClass name in string propertiesxwiki · xwiki-platform · CVSS 9.1 · 2024-08-19 | 9.1 | 0.5% | 2024-08-19 |
| CVE-2024-13268Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032Drupal · Opigno · CVSS 6.8 · 2025-01-09 | 6.8 | 0.5% | 2025-01-09 |
| CVE-2024-13264Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028Drupal · Opigno module · CVSS 9.8 · 2025-01-09 | 9.8 | 0.5% | 2025-01-09 |
| CVE-2022-3960Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')Hitachi Vantara · Pentaho Business Analytics Server · CVSS 6.3 · 2023-04-03 | 6.3 | 0.5% | 2023-04-03 |
| CVE-2026-108121Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of ServiceKoozali · SME Server · CVSS 6.9 · 2026-10-19 | 6.9 | 0.3% | 2026-10-19 |
| CVE-2025-7825Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiationwpt00ls · Schema Plugin For Divi, Gutenberg & Shortcodes · CVSS 6.3 · 2025-10-03 | 6.3 | 0.3% | 2025-10-03 |
| CVE-2024-13263Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027Drupal · Opigno group manager · CVSS 5.5 · 2025-01-09 | 5.5 | 0.3% | 2025-01-09 |
| CVE-2024-0788SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulationSUPERAntiSpyware · SUPERAntiSpyware Pro X · CVSS 6.6 · 2024-01-29 | 6.6 | 0.2% | 2024-01-29 |
| CVE-2026-127135SOGo before 5.12.13 Sieve Script Injection via Notification AddressAlinto · sogo · CVSS 4.3 · 2026-11-12 | 4.3 | 0.2% | 2026-11-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.