Variant weakness
Incomplete
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
116
Recorded CVEs
With this primary weakness
3
KEVs
In the CISA KEV catalog
Medium
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.