Payloads64
Test payloads from PayloadsAllTheThings by weakness class, passage by passage with their code blocks.
| Topic | Passages | Code blocks |
|---|---|---|
| Command and Code Injection | ||
| Server Side Template InjectionTemplate injection allows an attacker to include template code into an existing (or not) template. A template engine makes designing HTML pages easier by using static template files which at runtime replaces variables/placeholders with actual values in the HTML pages. | 126 | 117 |
| Command InjectionCommand injection is a security vulnerability that allows an attacker to execute arbitrary commands inside a vulnerable application. | 28 | 20 |
| Prompt InjectionA technique where specific prompts or cues are inserted into the input data to guide the output of a machine learning model, specifically in the field of natural language processing (NLP). | 8 | 3 |
| XSLT InjectionProcessing an un-validated XSL stylesheet can allow an attacker to change the structure and contents of the resultant XML, include arbitrary files from the file system, or execute arbitrary code | 8 | 14 |
| LaTeX InjectionLaTeX Injection is a type of injection attack where malicious content is injected into LaTeX documents. LaTeX is widely used for document preparation and typesetting, particularly in academia, for producing high-quality scientific and mathematical documents. Due to its powerful scripting capabiliti… | 5 | 12 |
| Server Side Include InjectionServer Side Includes (SSI) are directives that are placed in HTML pages and evaluated on the server while the pages are being served. They let you add dynamically generated content to an existing HTML page, without having to serve the entire page via a CGI program, or other dynamic technology. | 4 | 1 |
| CSV InjectionMany web applications allow the user to download content such as templates for invoices or user settings to a CSV file. Many users choose to open the CSV file in either Excel, Libre Office or Open Office. When a web application does not properly validate the contents of the CSV file, it could lead… | 3 | 2 |
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky. The repository. Data as of 2026-11-15.