CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
VariantIncompleteExploit Likelihood: Medium
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
View on MITREBack to CWE Lookup
Technical Details
- Structure
- Simple
Applicable To
JavaJavaScriptPythonPerlPHPRubyInterpreted