DerScanner
Home / Vulnerability Database / Python : Injection code
Python

Python : Injection code

Classification

OWASP Top 10 2013
A1-Injection
OWASP Top 10 2017
A1-Injection
OWASP Top 10 2021
A3-InjectionA8-Software and Data Integrity Failures
OWASP ASVS
Validation, Sanitization and EncodingValidation, Sanitization and EncodingValidation, Sanitization and EncodingValidation, Sanitization and Encoding
PCI DSS 4.0
6.2.4
CWE
CWE-94CWE-95CWE-829CWE-830CWE-1027
CWE/SANS Top 25 2011
CWE-829

Overview

Python is a particularly interesting tool for attackers due to its prevalence on server and developer machines, its ability to execute (exec) arbitrary code provided as data (as opposed to native binaries), and its complete lack of internal auditing.

References

  1. The exec statement
  2. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection
  3. CWE-829
  4. CWE-94
  5. CWE-95
MEDIUM

DerScanner Severity Score

Do you want to fix Python : Injection code in your application?

See also

Python

Python : Debug mode on

Python

Python : Web3: Deprecated method

Python

Python : Unsafe padding