input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : XPATH Query exec_query : xpath

Hardcoded string input filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH Query exec_query : xpath

input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : LDAP Query LDAP Query

input : shell commands filtering : remove semi-colon and all invalid filenames and chars in paths sink : LDAP Query LDAP Query

Hardcoded string input filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Hardcoded string input filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : check if there is only numbers sink : SQL query

Command line args filtering : check if there is only numbers sink : SQL query

Command line args Xpath replace char sink : run ls in a dir

input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : run ls in a dir

Hardcoded string input Xpath replace char construction : concatenation with simple quote

Hardcoded string input Xpath replace char construction : concatenation with simple quote

input : direct user input in string Xpath replace char construction : concatenation with simple quote

input : direct user input in string Xpath replace char construction : concatenation with simple quote

input : shell commands Xpath replace char construction : concatenation with simple quote

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter construction : concatenation with simple quote

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter construction : concatenation with simple quote

Hardcoded string input filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter construction : concatenation with simple quote

Hardcoded string input filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter construction : concatenation with simple quote

input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter construction : concatenation with simple quote

Command line args filtering : remove semi-colon and all invalid filenames and chars in paths construction : concatenation with simple quote

Hardcoded string input filtering : remove semi-colon and all invalid filenames and chars in paths construction : concatenation with simple quote

input : shell commands filtering : check if there is only numbers construction : concatenation with simple quote

input : shell commands no filtering construction : concatenation with simple quote