Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

CVEs (27)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-39726 1Mintty Project 1Mintty Jun 17, 2026 Oct 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
CVE-2022-43938 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (.prpt) through the JVM...Show more Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (.prpt) through the JVM script manager. Show less
CVE-2022-3960 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 6.3 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plug...Show more Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. Show less
CVE-2022-0895 1Microweber 1Microweber Jun 17, 2026 Mar 10, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
CVE-2021-39115 1Atlassian 2Jira Service Desk Jira Service Management Jun 17, 2026 Sep 1, 2021 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Tem...Show more Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.Show less
CVE-2020-6144 1Os4ed 1Opensis Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file...Show more A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.Show less
CVE-2020-6143 1Os4ed 1Opensis Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file...Show more A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.Show less

Previous 12