Browse / Code Execution

Code Execution

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Code Injection430
• Command Injection - Generic234
• OS Command Injection68
• Deserialization of Untrusted Data54
• Remote File Inclusion18
• Unrestricted Upload of File with Dangerous Type13
• Malware4
• Exposed Dangerous Method or Function3
• Use of Inherently Dangerous Function3
• Inclusion of Functionality from Untrusted Control Sphere3
• Download of Code Without Integrity Check1

Often found together with

• Memory Corruption156
• Cross-site Scripting86
• Access Control70
• Path Traversal66
• Information Disclosure50
• Injection and Smuggling47
• Misconfiguration40
• Server-Side Request Forgery38
• Denial of Service35
• SQL Injection34

Most upvoted Code Execution reports

AllValidInformativeN/ADuplicate

1. BAD Code ! N/ACommand Injection - Generic · Paragon Initiative Enterprises
   549 votes
2. wcurl Argument Injection via Unquoted VariableN/ACommand Injection - Generic · medium · curl
   43 votes
3. Internal application wrapper or script using curlN/ACode Injection · critical · curl
   29 votes
4. SMTP Command Injection Vulnerabilities in curlN/ACommand Injection - Generic · curl
   27 votes
5. SSTI leads to Command injectionN/ACommand Injection - Generic · curl
   25 votes
6. Argument Injection via curl Short-Flag GroupingN/ACommand Injection - Generic · critical · curl
   23 votes
7. Uncontrolled File Write/Arbitrary File Creation N/ACode Injection · high · curl
   20 votes
8. Title: Remote Code Execution (RCE) via Arbitrary Library Loading in `--engine` optionN/ACode Injection · critical · curl
   13 votes
9. # SCURLOPT_SSH_KNOWNHOSTS and host fingerprint pins are silently bypassed when an SSH connection is reused from the connection poolN/AExposed Dangerous Method or Function · curl
   9 votes
10. RCE (Remote Code Execution) Vulnerability on RubyN/ARemote File Inclusion · medium · Ruby
    9 votes
11. Host Header Injection/Redirection AttackN/ACommand Injection - Generic · Gratipay
    9 votes
12. Hash exposed in public repositoryN/AExposed Dangerous Method or Function · curl
    8 votes
13. Command Injection - CRITICISMN/ACommand Injection - Generic · curl
    8 votes
14. Potential XSS vector in curl via unsanitized URL parameter handlingN/ACode Injection · high · curl
    8 votes
15. Unrestricted file upload vulnerability in IMCEN/ARemote File Inclusion · medium · Acronis
    6 votes
16. OS Command Injection (subprocess Module Usage)N/AOS Command Injection · low · curl
    4 votes
17. Unexpected input validation of octal literals in nodejs v15.12.0 and below returns defined values for all undefined octal literals.N/AUse of Inherently Dangerous Function · critical · Node.js
    4 votes
18. Trojan:JS/CoinMiner in npm filesN/AMalware · high · Node.js third-party modules
    4 votes
19. Persistent CSV injectionN/ACode Injection · medium · Semrush
    4 votes
20. Nextcloud Server Remote Command ExecutionN/ACode Injection · high · Nextcloud
    4 votes
21. loader.js is not secureN/ACode Injection · Node.js
    3 votes
22. Server side includes in https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/savePublicInformation leads to 500 server error and D-DOSN/ACommand Injection - Generic · low · Semmle
    3 votes
23. Bootstrap library is vulnerableN/AInclusion of Functionality from Untrusted Control Sphere · low · Sifchain
    2 votes
24. Command injection in OptionParser.loadN/ACommand Injection - Generic · low · Ruby
    1 votes
25. HTML - injection N/ACode Injection · WakaTime
    1 votes
26. RCE,SQL,Vulnerability + Exploit Method.N/ACommand Injection - Generic · RubyGems
    1 votes
27. bypass to csv injectionN/ACommand Injection - Generic · Ian Dunn
    1 votes