weakness in Command and Code Injection
Code Injection
344 disclosed reports · $282,185 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 344
- paid a bounty
- 91
Every one of the 344 is a mark on the map. Named now: 1 to 26, most upvoted first.
- RCE via npm misconfig -- installing internal libraries from the public registry
- Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application
- [phpobject in cookie] Remote shell/command execution
- RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/
- Remote Code Execution in Slack desktop apps + bonus
- RCE when removing metadata with ExifTool
- SQL injection on contactws.contact-sys.com in TScenObject action ScenObjects leads to remote code execution
- RCE via unsafe inline Kramdown options when rendering certain Wiki pages
- Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message
- H1514 Server Side Template Injection in Return Magic email templates?
- Unrestricted file upload on [ambassador.mail.ru]
- Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
- RCE on shared.mail.ru due to "widget" plugin
- Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/upload
- RCE via npm misconfig -- installing internal libraries from the public registry
- Code injection possible with malformed Nextcloud Talk chat commands
- RCE on TikTok Ads Portal
- Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registry
- SQL Injection in www.hyperpure.com
- Unauthenticated SSRF in jira.tochka.com leading to RCE in confluence.bank24.int
- Publicly exposed SVN repository, ht.pornhub.com
- Remote Code Execution on contactws.contact-sys.com via SQL injection in TCertObject operation "Delete"
- Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql
- Path traversal, SSTI and RCE on a MailRu acquisition
- PHP code injection at tz.mail.ru
- uber.com may RCE by Flask Jinja2 Template Injection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.