Browse / Code Execution

Code Execution

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Code Injection430
• Command Injection - Generic234
• OS Command Injection68
• Deserialization of Untrusted Data54
• Remote File Inclusion18
• Unrestricted Upload of File with Dangerous Type13
• Malware4
• Exposed Dangerous Method or Function3
• Use of Inherently Dangerous Function3
• Inclusion of Functionality from Untrusted Control Sphere3
• Download of Code Without Integrity Check1

Often found together with

• Memory Corruption156
• Cross-site Scripting86
• Access Control70
• Path Traversal66
• Information Disclosure50
• Injection and Smuggling47
• Misconfiguration40
• Server-Side Request Forgery38
• Denial of Service35
• SQL Injection34

Most upvoted Code Execution reports

AllValidInformativeN/ADuplicate

1. Burp Suite extensions can execute arbitrary codeInformativeCode Injection · high · PortSwigger Web Security
   85 votes
2. MQTT Protocol Packet Injection via Unchecked CONNACK Remaining LengthInformativeCode Injection · low · curl
   45 votes
3. Arbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` NamespaceInformativeCode Injection · AWS VDP
   43 votes
4. mruby-engine: UAF in MRubyEngine#initialize enables local RCEInformativeCode Injection · Shopify
   35 votes
5. Remote Code Execution in Amazon MWAA due to outdated Apache Airflow versionInformativeCode Injection · AWS VDP
   24 votes
6. Jenkins Unauthenticated RCE on https://djangoci.com/InformativeOS Command Injection · critical · Django
   22 votes
7. Log4j CVE-2021–44228InformativeCode Injection · Krisp
   21 votes
8. Command Injection on Amazon Q Developer CLI via malicious .amazonq/mcp.json leads to arbitrary code executionInformativeCommand Injection - Generic · AWS VDP
   19 votes
9. Steam Deck Single Click Root Remote Code Execution InformativeCode Injection · high · Valve
   $75018 votes
10. Remote Code Execution through Deserialization Attack in OwnBackup app.InformativeDeserialization of Untrusted Data · critical · ownCloud
    16 votes
11. Node --run POSIX positional argument escaping allows shell command injectionInformativeOS Command Injection · high · Node.js
    13 votes
12. OS Command Injection in scripts/firefox-db2pem.sh via untrusted certificate nicknamesInformativeOS Command Injection · high · curl
    12 votes
13. HTML injection in API response including request urlInformativeRemote File Inclusion · critical · Reddit
    11 votes
14. Deserialization of potentially malicious data to RCEInformativeDeserialization of Untrusted Data · high · Django
    8 votes
15. Brew bootstrap process is insecureInformativeCode Injection · medium · Homebrew
    8 votes
16. Server-side Template Injection in lodash.js InformativeCode Injection · high · Node.js third-party modules
    8 votes
17. Reflected File Download on recipe list searchInformativeCommand Injection - Generic · Instacart
    7 votes
18. Remote file Inclusion - RFI in uploadInformativeCode Injection · Slack
    7 votes
19. --libcurl code injection via trigraphsInformativeCode Injection · low · curl
    6 votes
20. Sending arbitrary IPC messages via overriding Array.prototype.pushInformativeCommand Injection - Generic · critical · Brave Software
    6 votes
21. Arbitrary escape sequence injection in docker-machine from worker nodesInformativeCommand Injection - Generic · low · GitLab
    5 votes
22. Request Hijacking Vulnerability in RubyGems 2.6.13 and earlierInformativeCommand Injection - Generic · low · RubyGems
    5 votes
23. Possible RCEInformativeCommand Injection - Generic · Nextcloud
    5 votes
24. OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'InformativeOS Command Injection · medium · Ruby
    4 votes
25. Regex Injection from request header (Rack::Sendfile, send_file)InformativeCode Injection · Ruby on Rails
    4 votes
26. HTML injection in review contentInformativeCommand Injection - Generic · Judge.me
    4 votes
27. Wordpress 4.8.1 - Rogue editor leads to RCE. And the risks of same origin frame scripting in generalInformativeCode Injection · high · WordPress
    4 votes
28. links the user may download can be a malicious filesInformativeCode Injection · high · Brave Software
    4 votes
29. username enumeration InformativeCommand Injection - Generic · Blockchain
    4 votes
30. REG: Content provider information leakageInformativeCommand Injection - Generic · Nextcloud
    4 votes
31. 56: IBM i CL wrapper `parse_command_line()` never enters quote modeInformativeCommand Injection - Generic · curl
    3 votes
32. XMLRPC does not limit deserializable classes.InformativeDeserialization of Untrusted Data · high · Ruby
    3 votes
33. Dependency Confusion Vulnerability in Sifnode Due to Unclaimed npm Packages.InformativeCode Injection · Sifchain
    3 votes
34. Child process environment injection via prototype pollutionInformativeCode Injection · Node.js
    3 votes
35. OS Command Execution on User's PC via CSV InjectionInformativeOS Command Injection · medium · X / xAI
    2 votes
36. Export vault feature is vulnerable to CSV injectionInformativeOS Command Injection · Bitwarden
    2 votes
37. Bypassed or command injectionInformativeCommand Injection - Generic · Block.io
    2 votes
38. Dependency confusion in https://github.com/hyperledger/aries-mobile-agent-react-native InformativeCode Injection · Linux Foundation Decentralized Trust
    1 votes
39. Command Injection Vulnerability in win-fork/win-spawn PackagesInformativeCommand Injection - Generic · high · Node.js third-party modules
    1 votes
40. Command Injection, Information InformativeCommand Injection - Generic · Uber
    1 votes
41. DOM based XSS onInformativeCode Injection · Uber
    1 votes
42. Rank Creation function not validating user inputs.InformativeCommand Injection - Generic · WordPoints
    1 votes
43. DLL hijacking in Monero GUI for Windows 0.17.3.0 would allow an attacker to perform remote command executionInformativeCode Injection · medium · Monero