Code Injection
0 confirmed incidents.
VERIS: hacking:XPath injectionMITRE ATT&CK: T1190 (Exploit Public-Facing Application)T1202 (Indirect Command Execution)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Code injection covers an attack that gets malicious instructions executed by a public-facing application, a web form, API or file-upload path that fails to separate user input from the code or commands it triggers. It maps to two MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application), reaching the application through the vulnerability itself, and T1202 (Indirect Command Execution), using a trusted utility on the compromised system to run further commands while evading tools that only watch for a direct command-line call. Exposure follows once the injected code lets the attacker read or export the application's own data.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Code Injection on Breach Census?
0 confirmed incidents are currently classified as Code Injection.
Which MITRE ATT&CK techniques does the Code Injection classification cover?
This classification maps to MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application), T1202 (Indirect Command Execution).
What counts as a confirmed incident for the Code Injection classification?
An incident counts here once it carries the Code Injection attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.