CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- d-link dcs-930l, dlink dcs-930l firmware +1 moreD-Link DCS-930L alphapd setSystemAdmin command injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_wan_settings sub_415028 command injection5.3 Medium
- ruijie rg-ap720-l firmwareAuthenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated...7.2 High
- tykodev cherry-studio-tykoforkTykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injection5.3 Medium
- ugreen dh2100+UGREEN DH2100+ nas_svr create handler_file_backup_create command injection8.6 High
- sgai space1 nas n1211dsSGAI Space1 NAS N1211DS gsaiagent JSONAPI NGNIX_UPLOAD command injection5.3 Medium
- zspace q2c nas, q2c nas firmware +1 moreZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injection8.7 High
- zspace q2c nas, q2c nas firmware +1 moreZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection8.7 High
- zspace q2c nas, q2c nas firmware +1 moreZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection8.7 High
nitro-tpm-pcr-computecrates.ionitro-tpm-pcr-compute may allow kernel command line modification by an account operator6.0 Medium- edimax br-6478ac v3, br-6478ac v3 firmware +1 moreEdimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection5.1 Medium
- edimax br-6478ac v3, br-6478ac v3 firmware +1 moreEdimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection5.1 Medium
- edimax br-6478ac v3, br-6478ac v3 firmware +1 moreEdimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection5.1 Medium
- fanvil x210 firmwareAn issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local...5.1 Medium
- watchguard mobile vpn with ssl clientWatchGuard Mobile VPN with SSL Local Privilege Escalation via Update Package6.3 Medium
- flux159 mcp-server-kubernetesmcp-server-kubernetes potential security issue in exec_in_pod tool6.4 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code Command Validation Bypass Allows Arbitrary Code Execution8.7 High
- avtech dgm1104 firmwareAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an...8.8 High
- avtech dgm1104 firmwareAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an...6.5 Medium
- avtech dgm1104 firmwareAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an...8.8 High
- avtech dgm1104 firmwareAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an...8.8 High
- cactiSNMP Command Injection leads to RCE in Cacti7.4 High
- feehi feehicmsFeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management6.5 Medium
- dlink r15 firmwareA vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the...9.8 Critical
- adslr nbr1005gpev2, b-qe2w401 firmware +1 moreADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injection5.3 Medium
- adslr nbr1005gpev2, b-qe2w401 firmware +1 moreADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injection5.3 Medium
- adslr nbr1005gpev2, b-qe2w401 firmware +1 moreADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injection5.3 Medium
- adslr b-qe2w401, b-qe2w401 firmware +1 moreADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection5.3 Medium
- dontkry willitmergewillitmerge has a command Injection vulnerability6.9 Medium
- bjango istatsiStat Menus 7.10.4 - Local Privilege Escalation8.5 High
- blurams a31c firmwareAn issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers...6.8 Medium
- d-link dir-852, dlink dir-852 firmware +1 moreD-Link DIR-852 gena.cgi command injection6.9 Medium
- roocode roo code, roocodeinc roo-code +1 moreRoo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug8.1 High
- utt 进取 750w, 750w firmware +1 moreUTT 进取 750W formPdbUpConfig system command injection6.9 Medium
- thinkphpThe read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24...9.8 Critical
- ilevia eve x1 server firmwareAn issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 -...9.8 Critical
- arubanetworks arubaos, hewlett packard enterprise (hpe) hpe aruba networking 100 series cellular bridge +1 moreAuthenticated Command Injection Vulnerability Leading to Arbitrary Remote Command Execution6.5 Medium
- arubanetworks airwave, hewlett packard enterprise (hpe) hpe aruba networking management software (airwave) +1 moreAuthenticated Command Injection Vulnerability in HPE Aruba Networking Management Software (AirWave) CLI7.2 High
- pnetlabpnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter.6.5 Medium
- baryhuang aws resources mcp serverA code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that...6.5 Medium
- mcp server for data exploration project server for data explorationA command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp...6.5 Medium
- No product listedA remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers...6.5 Medium
- d-link dir-822k, dir-825m, dwr-m920 +5 more +7 moreD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection5.3 Medium
- gitlabImproper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab3.5 Low
- group-office group officeAn issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote...8.8 High
- totolink a950rg firmwareA command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c...6.5 Medium
- dlink dir-882 firmwareA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02...6.5 Medium
- dlink dir-882 firmwareA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02...6.5 Medium
- dlink dir-882 firmwareA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02...7.3 High
- dlink dir-882 firmwareA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02...7.3 High
- Show moreLoading…