CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- signalwire freeswitch FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands 9.8 Critical
- signalwire freeswitch FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia 8.8 High
- ntop ntopng ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) 8.8 High
- agentscope-ai agentscope agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection 6.9 Medium
- purocean yank note Purocean Yank Note Terminal index.ts checkPermission os command injection 5.3 Medium
- edimax br-6208ac Edimax BR-6208AC mp command injection 10.0 Critical
- xerrors yuxi Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise 9.9 Critical
- linksys e5350 Linksys E5350 apply.cgi system os command injection 10.0 Critical
- linksys wrt54gl Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection 9.4 Critical
- linksys wrt54gl Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection 9.4 Critical
- qihoo 360 d600-2, d603-2, d606-6 +2 more Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection 6.9 Medium
- qihoo 360 d600-2, d603-2, d606-6 +1 more +3 more Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 10.0 Critical
- No product listed On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a... 7.2 High
- hewlett packard enterprise (hpe) virtual intranet access (via) Authenticated Command Injection Vulnerability in HPE Networking VIA 7.2 High
- hewlett packard enterprise (hpe) virtual intranet access (via) Authenticated Local Command Injection Vulnerability in the VIA Client for Linux 7.8 High
- welotec tk100, tk500-v2, tk500-v3 +2 more Command Injection in IPsec VPN 8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 more Command Injection in WireGuard VPN 8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 more Command Injection in ZeroTier VPN 8.6 High
- wavlink wn551x3-a WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection 10.0 Critical
- wavlink wn551x3-a WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A protocol.csp host_black os command injection 9.4 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection 10.0 Critical
- shanghai xi yu ji zhi technology minimax code Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection 5.1 Medium
- wavlink wn553x1-b WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection 9.4 Critical
- wavlink wn701ae WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B ioos sub_416B50 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B ioos Service sub_416D88 os command injection 9.4 Critical
- wavlink wn701ae WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection 9.4 Critical
- wavlink wl-wn530be1-a WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection 10.0 Critical
- wavlink wl-wn530hg4b WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection 9.4 Critical
- wavlink wn579x3-d WAVLINK WN579X3-D wapi.cgi port_forward os command injection 9.4 Critical
- wavlink wl-wn579a3-a WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection 10.0 Critical
- sqlite SQLite CLI through 3.54.1 Command Injection via .recover Output 8.5 High
- tanium certificate manager Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. 8.8 High
- tanium threat response Tanium addressed an unauthorized code execution vulnerability in Threat Response. 8.8 High
- autodesk fusion post processor utility Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility 8.8 High
- desmondmorris node-tesseract desmondmorris node-tesseract Command Builder tesseract.js process os command injection 6.9 Medium
- watchguard fireware os Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation 8.7 High
- watchguard fireware os Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection 9.2 Critical
- totolink a950rg TOTOLINK A950RG firewall.so apmib_set command injection 9.4 Critical
- totolink a950rg TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection 9.4 Critical
- totolink a950rg TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection 9.4 Critical
- github-kanban-mcp-server Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection 5.3 Medium
- z.ai zcode Z.ai Zcode Sed Command Filter os command injection 5.3 Medium
- Show olderLoading…