CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- comfast cf-n1-sComfast CF-N1-S Endpoint mbox-config command injection5.3 Medium
- lawnchairLawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml7.4 High
- tenda w30e firmwareTenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the...9.8 Critical
- tenda w30e firmwareTenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the...7.3 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- liangliangyy djangoblogliangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection5.3 Medium
- apache airflowApache Airflow: Bad example of BashOperator shell injection via dag_run.conf8.8 High
- flowiseai flowiseFlowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability9.2 Critical
- mervinpraison praisonaiIncomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI9.8 Critical
- anviz cx2 lite firmwareAnviz CX2 Lite Command Injection8.8 High
- veeam backup and replication, software appliance +1 moreA vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver...6.7 Medium
- jetbrains junieIn JetBrains Junie before 252.549.29 command execution was possible via malicious project file5.8 Medium
- wavlink wl-wn530h4Wavlink WL-WN530H4 internet.cgi snprintf os command injection8.6 High
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.7 Medium
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...7.2 High
@paperclipai/servernpmPaperclip: Malicious skills able to exfiltrate and destroy all user data7.3 High- wwbn avideoWWBN AVideo vulnerable to RCE caused by clonesite plugin8.9 High
- electermelecterm has Command Injection Vulnerability via runMac function9.8 Critical
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability9.9 Critical
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Remote Code Execution Vulnerability9.9 Critical
upsonicPyPIUpsonic: remote code execution vulnerability in its MCP server/task creation functionality9.8 Critical- agent-zeroAgent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers...8.6 High
- No product listedLangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server...8.6 High
- No product listedJaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution...7.3 High
- No product listedA prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute...8.0 High
- thedaylightstudio fuel cmsDaylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution ...8.3 High
github.com/NietThijmen/ShoppingCartGo,govulncheck-vulndbopenSUSE +1 moreNietThijmen ShoppingCart: Command injection in the connect function8.4 High- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Snipping Tool Remote Code Execution Vulnerability7.8 High
- microsoft github copilot chat, visual studio code copilot chat extension +1 moreGitHub Copilot and Visual Studio Code Information Disclosure Vulnerability5.7 Medium
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +21 more +23 moreIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 High
- aandrew-me ytdownloaderaandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection4.8 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection9.3 Critical
- totolink n300rhTotolink N300RH upgrade.so setUpgradeUboot os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setWanCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection9.3 Critical
- danielmiessler personal ai infrastructuredanielmiessler Personal_AI_Infrastructure parse_url.ts os command injection5.3 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setLedCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection9.3 Critical
- chatboxai chatboxchatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection6.9 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection5.3 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection9.3 Critical
- Show moreLoading…