CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- scrapegraphai scrapegraph-aiScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection5.3 Medium
- moussaabbadla code-screenshot-mcpMoussaabBadla code-screenshot-mcp HTTP os command injection5.3 Medium
Tiryoh/actions-mkdocsGitHub Actionsactions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow6.5 Medium- amazon athena odbc driver, athena odbc +1 moreImproper neutralization of special elements in authentication components in Amazon Athena ODBC driver7.3 High
- dan mcinerney pymetasploit3pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()9.3 Critical
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi vpn_drop os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi vpn_connect os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi ping_test os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi edit os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi add_wps_client os command injection5.3 Medium
- tenda g103, g103 firmware +1 moreTenda G103 Setting gpon.lua action_set_net_settings command injection5.1 Medium
- tenda g103, g103 firmware +1 moreTenda G103 Setting system.lua action_set_system_settings command injection5.1 Medium
- defaultfuction content-management-system, content management system +1 moreDefaultFuction Content-Management-System tools.php command injection6.9 Medium
- efforthye fast-filesystem-mcpefforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection5.3 Medium
- cisco enterprise nfv infrastructure software, unified computing system (standalone), unified computing system e-series software (ucse) +2 more +4 moreCisco Integrated Management Controller Command Injection Vulnerability6.5 Medium
- cisco unified computing system (standalone), unified computing system e-series software (ucse), unified computing system +1 more +3 moreCisco Integrated Management Controller Command Injection Vulnerability8.8 High
- cisco enterprise nfv infrastructure software, unified computing system (standalone), unified computing system e-series software (ucse) +2 more +4 moreCisco Integrated Management Controller Command Injection Vulnerability6.5 Medium
- jeecg bootA command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3...9.8 Critical
- 1millionbot millie chat, millie chatbot +1 moreMultiple vulnerabilities in 1millionbot Millie chatbot8.7 High
- trendnet tew-713re, tew-713re firmware +1 moreTRENDnet TEW-713RE setSysAdm command injection5.3 Medium
- trendnet tew-713re, tew-713re firmware +1 moreTRENDnet TEW-713RE addRouting sub_421494 command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R cstecgi.cgi setIptvCfg command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R cstecgi.cgi setWiFiBasicCfg command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R cstecgi.cgi setSyslogCfg command injection6.9 Medium
- No product listedIn its design for automatic terminal command execution, Sixth offers two options: Execute safe...9.8 Critical
- tenda ch22, ch22 firmware +1 moreTenda CH22 WriteFacMac FormWriteFacMac command injection5.3 Medium
- raine consult-llm-mcpraine consult-llm-mcp server.ts child_process.execSync os command injection4.8 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreCommand Injection in mlflow/mlflow10.0 Critical
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R cstecgi.cgi setStaticRoute command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R cstecgi.cgi setUPnPCfg command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injection5.3 Medium
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R Parameter cstecgi.cgi setLanCfg command injection5.3 Medium
- njzjz wenxianwenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`9.8 Critical
- code-projects chamber of commerce membership management systemcode-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection5.1 Medium
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection5.3 Medium
- dedeveloper23 codebase-mcpDeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection4.8 Medium
- totolink a3600r, a3600r firmware +1 moreTotolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection5.3 Medium
- elecv2 elecv2pelecV2 elecV2P rpc pm2run os command injection6.9 Medium
- kazuph mcp-docs-ragkazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection4.8 Medium
- flannel-io flannelFlannel vulnerable to cross-node remote code execution via extension backend BackendData injection7.5 High
- openclawOpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface8.6 High
- netcore power 15axNetcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection8.7 High
- d-link dir-825, dir-825r +1 moreD-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injection8.6 High
- totolink x6000r, x6000r firmware +1 moreTOTOLINK X6000R shttpd setLanCfg privilege escalation8.6 High
- kalcaddle kodboxkalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection5.1 Medium
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection9.3 Critical
github.com/digitalocean/droplet-agentGo,govulncheck-vulndbopenSUSE +1 moreDigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint8.8 High- linksys mr9600, mr9600 firmware +1 moreLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injection8.7 High
- tenda f453, f453 firmware +1 moreTenda F453 WriteFacMac FormWriteFacMac privilege escalation5.3 Medium
- Show moreLoading…