Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
CWE-97
The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
Latest Improper Neutralization of Server-Side Includes (SSI) Within a Web Page vulnerabilities
- 7.5 High severity
Xperience: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through mali
- 9.0 Critical severity
Revolution Pi PiCtory: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due t
- 7.8 High severity
NetWorker Management Console: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization of server-side vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability a
- 7.8 High severity
APTRS: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input
- 7.2 High severity
strongshop: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.
- 7.2 High severity
winter: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be en