CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- kalcaddle kodboxkalcaddle kodbox Compression zip command injection5.3 Medium
- bastillion-io bastillionbastillion-io Bastillion System Management SystemKtrl.java command injection5.1 Medium
- bastillion-io bastillionbastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injection5.1 Medium
- apache brpcApache bRPC: Remote command injection vulnerability in heap builtin service9.8 Critical
- delta electronics diaviewDIAView - Command Injection Vulnerability7.8 High
- denoDeno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass8.1 High
- anysphere cursorCursor has a Terminal Tool Allowlist Bypass via Environment Variables7.2 High
- renovatebot renovateRenovate 31.51.0 before 40.33.0 Command Injection via helmv38.4 High
- renovatebot renovateRenovate 39.53.0 before 40.33.0 Command Injection via gleam manager8.4 High
- renovatebot renovateRenovate 32.135.0 before 40.33.0 Command Injection via hermit8.4 High
- renovatebot renovateRenovate 35.63.0 before 40.33.0 Command Injection via npm8.4 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow6.5 Medium
- renovatebot renovateRenovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize8.4 High
- vivotek affected device model numbers are fd8365, fd8365v2, fd9165, fd9171, fd9187, fd9189, fd9365, fd9371, fd9381, fd9387, fd9389, fd9391,fe9180,fe9181, fe9191, fe9381, fe9382, fe9391, fe9582, ib9365, ib93587lpr, ib9371,ib9381, ib9387, ib9389, ib939,ip9165,ip9171, ip9172, ip9181, ip9191, it9389, ma9321, ma9322, ms9321, ms9390, tb9330Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi9.3 Critical
- orvalorval MCP client is vulnerable to a code injection attack.9.3 Critical
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System session SessionController os command injection6.9 Medium
- openprojectOpenProject is Vulnerable to Code Execution in E-Mail function8.6 High
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection9.3 Critical
- sangfor operation and maintenance management systemSangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection9.3 Critical
- sangfor operation and maintenance management systemSangfor Operation and Maintenance Management System VersionController.java uploadCN os command injection8.7 High
- tencent weknoraWeKnora has Command Injection in MCP stdio test10.0 Critical
- zenitel icx500, icx500 firmware, icx510 +1 more +3 moreUnauthenticated Remote Code Execution via the device hostname10.0 Critical
- zenitel tcis-3+, tcis-3 firmware +1 moreAuthenticated Remote Code Execution in device hostname10.0 Critical
- edimax br-6208ac firmwareEDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName...9.8 Critical
- dlink dir-895la1 firmwareA Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link...9.8 Critical
- axtion odisA DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute...6.5 Medium
- d-link di-8200g, dlink di-8200g firmware +1 moreD-Link DI-8200G upgrade_filter.asp command injection5.3 Medium
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup Operator to perform remote code execution (RCE) as the...9.0 Critical
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the...9.0 Critical
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as...7.8 High
- ubiquiti inc airfiber af60, airfiber af60-xg, airmax ac +5 more +7 moreA malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the...8.8 High
- ubiquiti inc ubb, ubb-xg, udb-pro/udb-pro-sector +4 more +6 moreA malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the...8.8 High
- gl-inet gl-axt1800 firmwareA command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The...8.1 High
- optimal-systems enaioAn issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10...9.1 Critical
- gongrzhe terminal-controller-mcpterminal-controller-mcp vulnerable to Command Injection10.0 Critical
- sonirico mcp-shellA command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows...6.5 Medium
- trendnet tew-811dru, tew-811dru firmware +1 moreTRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injection8.6 High
- trendnet tew-713re, tew-713re firmware +1 moreTRENDnet TEW-713RE formFSrvX os command injection9.3 Critical
- totolink wa300, wa300 firmware +1 moreTOTOLINK WA300 cstecgi.cgi sub_401510 command injection5.3 Medium
- coollabs coolifyColify has command injection vulnerability in project git source9.4 Critical
- coollabs coolifyCoolify vulnerable to command injection via docker-compose.yaml parameters9.7 Critical
- tenda ac1206, ac1206 firmware +1 moreTenda AC1206 httpd BehaviorManager formBehaviorManager command injection5.3 Medium
- passyAn issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands...9.1 Critical
- d-link dir-806a, dlink dir-806a firmware +1 moreD-Link DIR-806A SSDP Request ssdpcgi_main command injection5.3 Medium
- d-link di-7400g+, dlink di-7400g\+ firmware +1 moreD-Link DI-7400G+ msp_info.htm command injection5.3 Medium
- serverlessserverless MCP Server vulnerable to command injection in list-projects tool7.5 High
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC Web-based Configuration formRoute command injection6.9 Medium
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC Web-based Configuration formStaDrvSetup command injection6.9 Medium
- tenda w6-s, w6-s firmware +1 moreTenda W6-S ATE Service ate TendaAte os command injection5.3 Medium
- quenary tugtainerTugtainer has RCE in Agent Command Execution Api8.1 High
- Show moreLoading…