地图 / 代码注入

代码注入

Code Injection · 代码执行

代码执行 / 代码注入

344公开报告

—CWE 编号

0已标注发现方式

344关联报告

发现方式分布

暂无发现方式标注。

关联报告

RCE via npm misconfig -- installing internal libraries from the public registryPayPal · 2021-02-09 · 高危 · $30,000 · 946 票 Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationPlayStation · 2020-12-04 · 高危 · $15,000 · 780 票 [phpobject in cookie] Remote shell/command executionPornhub · — · 未评级 · $20,000 · 607 票 RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Starbucks · 2019-04-10 · 高危 · 572 票 Remote Code Execution in Slack desktop apps + bonusSlack · 2020-08-28 · 高危 · 509 票 RCE when removing metadata with ExifToolGitLab · 2021-05-14 · 高危 · $20,000 · 508 票 SQL injection on contactws.contact-sys.com in TScenObject action ScenObjects leads to remote code executionQIWI · — · 未评级 · 475 票 RCE via unsafe inline Kramdown options when rendering certain Wiki pagesGitLab · 2021-04-20 · 高危 · $20,000 · 427 票 Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageValve · 2019-10-08 · 高危 · 420 票 H1514 Server Side Template Injection in Return Magic email templates?Shopify · 2019-04-04 · 未评级 · 409 票 Unrestricted file upload on [ambassador.mail.ru]Mail.ru · — · 未评级 · $3,000 · 404 票 Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Mozilla · 2026-08-05 · 高危 · $12,000 · 361 票 RCE on shared.mail.ru due to "widget" pluginMail.ru · — · 未评级 · $10,000 · 359 票 Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/uploadFlickr · 2020-01-25 · 高危 · 340 票 RCE via npm misconfig -- installing internal libraries from the public registryUber · 2021-02-24 · 高危 · $9,000 · 325 票 Code injection possible with malformed Nextcloud Talk chat commandsNextcloud · 2020-06-02 · 中危 · 317 票 RCE on TikTok Ads PortalTikTok · 2021-04-15 · 高危 · 312 票 Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registryLY Corporation · 2021-07-05 · 高危 · $11,500 · 288 票 SQL Injection in www.hyperpure.comEternal · 2021-02-22 · 高危 · $2,000 · 229 票 Unauthenticated SSRF in jira.tochka.com leading to RCE in confluence.bank24.intQIWI · — · 未评级 · 221 票 Publicly exposed SVN repository, ht.pornhub.comPornhub · — · 未评级 · $10,000 · 211 票 Remote Code Execution on contactws.contact-sys.com via SQL injection in TCertObject operation "Delete"QIWI · — · 未评级 · 194 票 Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlHackerOne · 2026-06-17 · 中危 · $7,000 · 174 票 Path traversal, SSTI and RCE on a MailRu acquisitionMail.ru · — · 未评级 · $2,000 · 152 票 PHP code injection at tz.mail.ruMail.ru · — · 未评级 · $3,000 · 137 票 uber.com may RCE by Flask Jinja2 Template InjectionUber · 2016-04-06 · 未评级 · $10,000 · 137 票 Urgent: Server side template injection via Smarty template allows for RCEUnikrn · 2017-08-17 · 未评级 · 122 票 Unserialize leading to arbitrary PHP function invokeRockstar Games · 2017-12-13 · 高危 · 119 票 Remote Code Execution on Git.imgur-dev.comImgur · 2017-04-16 · 高危 · 119 票 SQL injection on contactws.contact-sys.com in TRateObject.AddForOffice in USER_ID parameter leads to remote code executionQIWI · — · 未评级 · 118 票 Public instance of Jenkins on https://██████████/ with /script enabledU.S. Dept Of Defense · 2020-01-31 · 高危 · 118 票 Remote Code Execution (Reverse Shell) - File ManagerConcrete CMS · 2020-07-21 · 低危 · 114 票 Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsSlack · 2021-05-09 · 中危 · 107 票 [hta3] Remote Code Execution on ████U.S. Dept Of Defense · 2023-05-15 · 高危 · 104 票 Remote Unrestricted file Creation/Deletion and Possible RCE.X / xAI · 2017-02-26 · 低危 · 100 票 Injection in path parameter of Ingress-nginxKubernetes · 2026-03-07 · 中危 · 91 票 Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_IDQIWI · — · 未评级 · 84 票 Remote Code Execution (RCE) in a DoD websiteU.S. Dept Of Defense · 2019-10-04 · 高危 · 84 票 OneLogin authentication bypass on WordPress sites via XMLRPCUber · 2016-07-15 · 未评级 · $7,000 · 83 票 In correct casting from size_t to int lead to heap overflow in mcrypt_genericInternet Bug Bounty · 2019-11-12 · 未评级 · $1,000 · 81 票 Entire database of emails exposed through URN injectionLinkedIn · 2023-05-22 · 低危 · 79 票 HTML Injection in Business Name Parameter in PayappsAutodesk · 2025-04-07 · 低危 · 75 票 CVE-2021-40870 on [52.204.160.31]Elastic · 2021-10-06 · 高危 · 75 票 Public Jenkins instance with /script enabledUbiquiti Inc. · 2018-09-10 · 高危 · 74 票 RCE on facebooksearch.algolia.comAlgolia · 2016-10-01 · 未评级 · $500 · 74 票 Unsecured DB instancePornhub · — · 未评级 · $5,000 · 73 票 RCE on █████ via CVE-2017-10271U.S. Dept Of Defense · 2019-07-01 · 高危 · 68 票 GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability]Internet Bug Bounty · 2019-10-13 · 中危 · 68 票 [RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182IBM · 2025-12-18 · 高危 · 67 票 CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesKubernetes · 2023-12-21 · 中危 · $5,000 · 67 票 Persistant Arbitrary code execution in mattermost androidMattermost · 2021-06-03 · 中危 · 67 票 YQL: From CR/LF injection to root compromiseYahoo! · — · 未评级 · 67 票 Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)MercadoLibre · 2024-06-28 · 中危 · 66 票 Source Code and data exfiltration via Github CopilotGitHub · 2024-08-19 · 低危 · 63 票 Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.comUdemy · 2017-06-17 · 中危 · 63 票 CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash exampleInternet Bug Bounty · 2023-01-05 · 中危 · $4,000 · 60 票 Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business serverMTN Group · 2023-12-31 · 高危 · 59 票 Arbitrary code execution in desktop client via OpenSSL configNextcloud · 2020-08-05 · 低危 · $100 · 59 票 Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cacheMozilla · 2024-01-20 · 高危 · $8,000 · 58 票 Ingress nginx annotation injection causes arbitrary command executionKubernetes · 2023-11-24 · 中危 · $2,500 · 57 票 RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.comMozilla · 2024-12-08 · 低危 · $500 · 56 票 Remote Code Execution on contactws.contact-sys.com via SQL injection in TPrabhuObject.BeginOrder in parameter DOC_IDQIWI · — · 未评级 · 52 票 RCE in 'Copy as Node Request' BApp via code injectionPortSwigger Web Security · 2021-04-22 · 低危 · 51 票 WordPress SOME bug in plupload.flash.swf leading to RCEAutomattic · 2016-07-10 · 未评级 · 50 票 Remote Code Execution (RCE) at "juid" parameter in /get_zip.php (printshop.engelvoelkers.com)Engel & Völkers Technology GmbH · — · 未评级 · 49 票 Log4Shell: RCE 0-day exploit on █████████U.S. Dept Of Defense · 2022-01-03 · 高危 · 48 票 Remote Code Execution in Basecamp Windows Electron AppBasecamp · 2020-11-19 · 中危 · 48 票 Java Deserialization RCE via JBoss on card.starbucks.inStarbucks · 2017-05-22 · 高危 · 48 票 Synthetics Recorder: Code injection when recording website with malicious contentElastic · 2023-04-08 · 中危 · 47 票 RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path fieldKubernetes · 2023-10-26 · 中危 · $2,500 · 47 票 PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingRevive Adserver · 2026-06-25 · 中危 · 46 票 CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ciMTN Group · 2024-11-16 · 高危 · 46 票 F5 BIG-IP TMUI RCE - CVE-2020-5902 (██.packet8.net)8x8 · 2022-03-25 · 高危 · 46 票 RCE via Local File Read -> php unserialization-> XXE -> unpicklingh1-5411-CTF · 2018-10-22 · 高危 · 46 票 RCE due to ImageTragick v2pixiv · 2021-03-16 · 高危 · $2,000 · 44 票 forum.getmonero.org Shell uploadMonero · 2018-07-27 · 中危 · 43 票 Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.inStarbucks · 2017-02-03 · 未评级 · 42 票 RCE by parsing `.rdoc_options` in RDocRuby · 2024-07-03 · 未评级 · 41 票 Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotationKubernetes · 2023-10-25 · 中危 · $2,500 · 40 票 Log4j RCE on https://judge.me/reviewsJudge.me · 2021-12-21 · 低危 · $50 · 40 票 HTML injection in email at https://www.hackerone.com/HackerOne · 2023-05-12 · 低危 · 40 票 Command Injection using malicious hostname in expanded proxycommandInternet Bug Bounty · 2024-02-28 · 低危 · $540 · 39 票 WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCEWordPress · 2026-10-21 · 中危 · 37 票 Code injection in Nextcloud Desktop Client for macOSNextcloud · 2024-06-14 · 未评级 · $250 · 37 票 PHP code injection via delivery limitation logicalRevive Adserver · 2026-06-03 · 中危 · 36 票 Remote Code Execution on ██.8x8.com via .NET VSTATE Deserialization8x8 · 2022-02-03 · 高危 · 36 票 HTML Injection through Account Name field on TikTok ads portal being rendered on emailsTikTok · 2021-03-19 · 低危 · 36 票 PHP code injection in delivery-limitation `logical` validation bypassRevive Adserver · 2026-06-25 · 中危 · 35 票 Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script.Rocket.Chat · 2018-08-28 · 低危 · 35 票 Type confusion in wrap_decimal leading to memory corruptionshopify-scripts · 2017-01-15 · 高危 · 35 票 Remote code execution as root on [REDACTED]Zendesk · — · 未评级 · 35 票 XML Parser Bug: XXE over which leads to RCEdrchrono · 2016-06-13 · 未评级 · 35 票 Log4j Java RCE in [beta.dev.adobeconnect.com]Adobe · — · 未评级 · 34 票 Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesKubernetes · 2022-08-13 · 中危 · 34 票 SQL injection my method -1 OR 3*2*1=6 AND 000159=000159U.S. Dept Of Defense · 2021-07-29 · 低危 · 32 票 Full UI hijack via dormant browser service workersAugur · — · 未评级 · $1,000 · 32 票 RCE in profile picture uploadHackerOne · 2016-06-08 · 未评级 · 32 票 Code Injection in macOS Desktop ClientMail.ru · — · 未评级 · 31 票 Remote code execution on an Army websiteU.S. Dept Of Defense · 2017-01-12 · 高危 · 31 票 Code execution in "ymon" WebService, reached after bypassing the anti-loopback blacklist through YQL and HTTP redirectsYahoo! · — · 未评级 · 31 票

查看全部 344 份报告 →