CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_password os command injection5.1 Medium
- utt hiper 810, 810 firmware +1 moreUTT HiPER 810 formUser setSysAdm command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Web Management set_ac_server os command injection5.1 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_ipv6 sub_424D20 os command injection5.1 Medium
- dcn dcme-320, dcnetworks dcme-320 firmware +1 moreDCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection5.1 Medium
- zenitel tcis-3+, tcis-3 firmware +1 moreAuthenticated Remote Code Execution via the file name of an uploaded file10.0 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 zrMacClone.lua macAddrClone command injection6.9 Medium
- yealink meetingbar a30Yealink MeetingBar A30 Diagnostic command injection2.4 Low
- tenda hg10, hg10 firmware +1 moreTenda HG10 formSysCmd system command injection5.1 Medium
- tenda hg10, hg10 firmware +1 moreTenda HG10 Login formLogin checkUserFromLanOrWan command injection6.9 Medium
- tenda hg10, hg10 firmware +1 moreTenda HG10 Boa Webserver formSamba command injection6.9 Medium
- johnson controls metasysMetasys product command injection vulnerability could allow remote SQL execution9.5 Critical
- hiksemi hs-afs-s1h1Due to insufficient input parameter validation on the interface, authenticated users of certain...7.2 High
- tenda ac21, ac21 firmware +1 moreTenda AC21 mDMZSetCfg command injection5.3 Medium
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection5.3 Medium
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 formLtefotaUpgradeFibocom command injection5.3 Medium
- moonshotai kimi-agent-sdk[Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js2.9 Low
- inspektor-gadget, linuxfoundation inspektor gadget +1 moreInspektor Gadget has a Command Injection vulnerability in Makefile.build6.6 Medium
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi setUpgradeFW command injection5.3 Medium
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi setUploadUserData command injection5.3 Medium
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection5.3 Medium
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection5.3 Medium
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi setUnloadUserData command injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_mode sub_41E2A0 os command injection5.3 Medium
- openprojectOpenProject has Argument Injection on Repository module that allows Arbitrary File Write9.4 Critical
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injection8.6 High
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 URL Filter set_temp_nodes.php os command injection8.6 High
- browserstack browserstack-local, red hat fuse 7 +1 moreBrowserStack Local vulnerable to Command Injection through logfile variable7.8 High
- netgear r6230 firmware, r6260 firmware, r7000 firmware +7 more +9 moreFunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an...7.7 High
@saltcorn/servernpmSaltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE9.6 Critical- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection8.6 High
- tp-link archer mr600 firmware, tp-link systems inc. archer mr600 v5.0 +1 moreAuthenticated Command Injection Vulnerability in Archer MR6008.5 High
- apache continuumApache Continuum: Command injection leading to RCE9.9 Critical
- d-link dcs700l, dlink dcs-700l firmware +1 moreD-Link DCS700l Web Form setDayNightMode command injection5.1 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection5.3 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request port_validate portValidate command injection5.3 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injection6.9 Medium
- algo 8180 ip audio alerter, algosolutions 8180 ip audio alerter firmware +1 moreALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability7.2 High
- microsoft copilot studioCopilot Studio Information Disclosure Vulnerability7.5 High
- orvalOrval Mock Generation Code Injection via const7.7 High
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection5.3 Medium
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setWanCfg command injection5.3 Medium
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injection8.7 High
- python software foundation cpythonPOP3 command injection in user-controlled commands5.9 Medium
- python software foundation cpythonIMAP command injection in user-controlled commands5.9 Medium
- orvalOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation9.3 Critical
- tosei online store management system ネット店舗管理システム, tosei-corporation online store management system +1 moreTosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection6.9 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection5.3 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_wifidog_settings sub_412E7C command injection6.9 Medium
- Show moreLoading…