地图 / 命令注入（通用）

命令注入（通用）

Command Injection - Generic · 代码执行

代码执行 / 命令注入（通用）

234公开报告

—CWE 编号

0已标注发现方式

234关联报告

发现方式分布

暂无发现方式标注。

关联报告

H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsShopify · 2020-02-06 · 低危 · 830 票 Remote Code Execution on www.semrush.com/my_reports on Logo uploadSemrush · 2019-06-24 · 高危 · 824 票 Git flag injection - local file overwrite to remote code executionGitLab · 2019-12-19 · 高危 · $12,000 · 777 票 Privilege Escalation From user to SYSTEM via unauthenticated command executionUbiquiti Inc. · 2019-11-08 · 高危 · 553 票 BAD Code !Paragon Initiative Enterprises · 2016-11-04 · 低危 · 549 票 Local files could be overwritten in GitLab, leading to remote command executionGitLab · 2019-07-17 · 高危 · $12,000 · 542 票 Remote code execution on Basecamp.comBasecamp · 2020-11-26 · 高危 · $5,000 · 417 票 Remote Command Execution via Github importGitLab · 2022-10-06 · 高危 · $33,510 · 392 票 RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)GitLab · 2022-09-13 · 高危 · $33,510 · 387 票 RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`Imgur · 2017-04-26 · 高危 · 229 票 Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issuesMapbox · 2020-07-28 · 高危 · 209 票 RCE of Burp Scanner / Crawler via ClickjackingPortSwigger Web Security · 2023-10-10 · 中危 · $3,000 · 172 票 Git flag injection leading to file overwrite and potential remote code executionGitLab · 2019-12-19 · 高危 · $3,500 · 169 票 JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)Mail.ru · — · 未评级 · $2,000 · 163 票 $50 million CTF Writeup50m-ctf · — · 未评级 · 152 票 Path traversal, to RCEGitLab · 2022-06-07 · 中危 · $12,000 · 142 票 Send arbitrary PUT requests when user clicks on a linkGitLab · 2020-07-27 · 低危 · 135 票 Apache Flink RCE via GET jar/plan API EndpointAiven Ltd · 2022-11-08 · 高危 · $6,000 · 134 票 Admin Panel Accessed (OAuth Bypassed )Mapbox · 2017-12-21 · 高危 · $4,000 · 133 票 Git flag injection - Search API with scope 'blobs'GitLab · 2019-12-15 · 中危 · $7,000 · 130 票 Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/U.S. Dept Of Defense · 2024-12-18 · 高危 · 114 票 Insecure Bundler configuration fetching internal Gems (okra) from Rubygems.orgBasecamp · 2021-08-10 · 中危 · $5,000 · 102 票 No SearchEngine sanatizing can lead to command injectionNotepad++ · 2019-06-06 · 低危 · 99 票 [insideok.ru] Remote Command Execution via file upload.ok.ru · 2019-09-20 · 高危 · 98 票 LOGJ4 VUlnerability [HtUS]U.S. Dept Of Defense · 2022-11-18 · 高危 · $1,000 · 94 票 Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-checkGitHub · 2024-09-17 · 中危 · 88 票 [app-01.youdrive.club] RCE in CI/CD via dependency confusionMail.ru · — · 未评级 · 84 票 Middleware Authentication Bypass on IBM PortalIBM · 2025-05-02 · 高危 · 80 票 Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forwardGitHub · 2024-09-13 · 中危 · 80 票 Pre-auth Remote Code Execution on multiple Uber SSL VPN serversUber · 2021-02-24 · 高危 · $2,000 · 80 票 OSX slack:// protocol handler javascript injectionSlack · 2016-06-24 · 未评级 · 72 票 Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injectionGitHub · 2024-09-13 · 中危 · 61 票 Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ngGitHub · 2024-09-13 · 中危 · 61 票 Remote Code Execution at http://tw.corp.ubnt.comUbiquiti Inc. · 2017-11-29 · 高危 · 61 票 Blind OOB XXE At "http://ubermovement.com/"Uber · 2016-08-08 · 未评级 · $500 · 56 票 Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_largeValve · 2024-07-30 · 高危 · 53 票 Sending arbitrary IPC messages via overriding Function.prototype.applyBrave Software · 2018-09-18 · 高危 · 53 票 Command injection by setting a custom search engineNotepad++ · 2019-05-07 · 低危 · 50 票 Insufficient sanitizing can lead to arbitrary commands executionNotepad++ · 2019-06-06 · 低危 · 50 票 Command injection by overwriting authorized_keys file through GitLab importGitLab · 2018-04-27 · 高危 · $2,000 · 50 票 [careers.informatica.com] Reflected Cross Site Scripting to XSS Shell PossibleInformatica · 2016-12-31 · 中危 · 50 票 Remote Code Execution at https://169.38.86.185/ (edst.ibm.com)IBM · 2021-11-04 · 高危 · 49 票 Cisco IOS XE instance at ████ vulnerable to CVE-██████MTN Group · 2025-02-19 · 高危 · 48 票 Wordpress Content injectionPornhub · — · 未评级 · $1,500 · 48 票 Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectdGitHub · 2024-09-17 · 中危 · 47 票 Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-consoleGitHub · 2024-09-17 · 中危 · 47 票 CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com]MTN Group · 2025-02-22 · 中危 · 47 票 WG call injection in /economy/contextcommandValve · 2024-07-30 · 高危 · 47 票 CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGsInternet Bug Bounty · 2022-04-01 · 中危 · 46 票 Admin Command Injection via username in user_archive ExportCsvFileDiscourse · 2017-05-13 · 中危 · $512 · 45 票 Read-Only user can execute arbitraty shell commands on AirOSUbiquiti Inc. · 2016-08-05 · 未评级 · 44 票 wcurl Argument Injection via Unquoted Variablecurl · 2026-01-26 · 低危 · 43 票 View Only to Root Privilege Escalation on UniFi ProtectUbiquiti Inc. · 2021-05-23 · 中危 · 42 票 Blind Command Injection #18x8 · 2020-06-22 · 中危 · 42 票 RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Ruby on Rails · 2019-03-13 · 中危 · $1,500 · 41 票 Command injection on Phabricator instance with an evil hg branch namePhabricator · 2017-11-11 · 高危 · 41 票 CSV Injection at https://assets-paris-demo.codefi.network/MetaMask · 2023-01-04 · 低危 · $500 · 40 票 POOL_UPGRADE request handler may allow an unauthenticated attacker to remotely execute code on every node in the network.Linux Foundation Decentralized Trust · 2022-10-20 · 高危 · $2,000 · 39 票 RCE Possible Via Video Manager Export using @ character in Video TitlePornhub · — · 未评级 · $500 · 38 票 LFI at http://www.████Sony · 2022-12-16 · 中危 · 37 票 Command injection in PathnameRuby · 2019-04-01 · 未评级 · 36 票 OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)Central Security Project · 2019-10-29 · 高危 · 34 票 RCE via File Upload with a Null Byte Truncated File Extension at https://██████/U.S. Dept Of Defense · 2023-12-21 · 高危 · 33 票 Vulnerability in project import leads to arbitrary command executionGitLab · 2018-08-22 · 高危 · 32 票 Unrestricted File UploadU.S. Dept Of Defense · 2016-12-22 · 高危 · 31 票 NET::Ftp allows command injection in filenamesRuby · 2017-12-19 · 低危 · 28 票 Attention! Remote Code Execution at http://wpt.ec2.shopify.com/Shopify · 2015-07-16 · 未评级 · 28 票 SMTP Command Injection Vulnerabilities in curlcurl · 2025-09-26 · 未评级 · 27 票 Readonly to Root Privilege Escalation on EdgeSwitchUbiquiti Inc. · 2021-05-23 · 中危 · 27 票 [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 usersUbiquiti Inc. · 2017-07-21 · 低危 · 27 票 Command Injection (via CVE-2019-11510 and CVE-2019-11539)U.S. Dept Of Defense · 2020-05-07 · 高危 · 26 票 SSTI leads to Command injectioncurl · 2026-03-04 · 低危 · 25 票 Argument Injection via curl Short-Flag Groupingcurl · 2026-04-13 · 高危 · 23 票 CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dagInternet Bug Bounty · 2022-09-23 · 中危 · 22 票 Unauthorized command execution in Web protection component of Anti-Virus products family [IE]Kaspersky · 2019-11-24 · 低危 · 22 票 Read-Only user can execute arbitraty shell commands on AirOSUbiquiti Inc. · 2016-08-05 · 未评级 · 22 票 Rocket.Chat Server RCERocket.Chat · 2023-03-04 · 高危 · 21 票 Kaspersky Protection extension for Google Chrome is vulnerable to abuse its featuresKaspersky · 2019-11-25 · 低危 · 21 票 RCE By import channel fieldExpressionEngine · 2018-04-20 · 中危 · 21 票 Bypass incomplete fix of CVE-2024-27980Node.js · 2024-07-09 · 中危 · 20 票 CSV Injection https://hub.grab.comGrab · 2017-10-27 · 低危 · 20 票 CSV injection in gitlab.com via issues export feature.GitLab · 2017-07-21 · 低危 · 20 票 Shell Injection via Web Management Console (dl-fw.cgi)Ubiquiti Inc. · 2016-10-15 · 未评级 · 20 票 Command Injection on Amazon Q Developer CLI via malicious .amazonq/mcp.json leads to arbitrary code executionAWS VDP · 2026-01-16 · 低危 · 19 票 [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████U.S. Dept Of Defense · 2021-03-24 · 中危 · 19 票 RCE on partner.steampowered.comValve · 2024-07-30 · 高危 · 19 票 HTML injection in email in unikrn.comUnikrn · 2017-08-23 · 中危 · 18 票 Read-Only user can execute arbitraty shell commands on AirOSUbiquiti Inc. · 2016-08-05 · 未评级 · 18 票 Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution8x8 · 2024-08-26 · 低危 · 17 票 Site support SNI But Browser can'tParagon Initiative Enterprises · 2016-07-05 · 未评级 · 17 票 HTML Injection into https://www.██████.milU.S. Dept Of Defense · 2024-07-19 · 低危 · 16 票 Arbitrary Code Injection in ownCloud’s Windows ClientownCloud · 2016-11-23 · 未评级 · 16 票 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab InstancesGitLab · 2022-02-10 · 低危 · 15 票 EdgeSwitch Command InjectionUbiquiti Inc. · 2019-03-31 · 低危 · 15 票 [pdfinfojs] Command Injection on filename parameterNode.js third-party modules · 2018-04-19 · 中危 · 15 票 Cookie Injection at 'harvestapp.com'Harvest · — · 未评级 · $300 · 15 票 CSV Injection at Camptix Event TicketingIan Dunn · 2016-08-18 · 未评级 · 15 票 CSV Injection at the CSV export featureHackerOne · 2019-04-08 · 低危 · 15 票 [ascii-art] Command injectionNode.js third-party modules · 2018-09-08 · 中危 · 14 票 Code Injection in Slack's Windows Desktop Client leads to Privilege EscalationSlack · 2017-07-14 · 未评级 · 14 票

查看全部 234 份报告 →