CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection9.3 Critical
- edimax br-6675ndEdimax BR-6675nD POST Request formWlanMP command injection5.3 Medium
- edimax br-6675ndEdimax BR-6675nD POST Request formUSBStorage command injection5.3 Medium
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection9.3 Critical
- edimax br-6675ndEdimax BR-6675nD POST Request formWpsStart command injection5.3 Medium
- edimax br-6675ndEdimax BR-6675nD POST Request formHwSet command injection5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection6.9 Medium
- edimax ew-7438rpnEdimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection5.3 Medium
- edimax ew-7438rpnEdimax EW-7438RPn Setting formConnectionSetting command injection5.3 Medium
- edimax ew-7438rpnEdimax EW-7438RPn POST Request formAccep formAccept command injection5.3 Medium
- edimax ew-7438rpnEdimax EW-7438RPn POST Request formHwSet command injection5.3 Medium
- edimax ew-7438rpnEdimax EW-7438RPn webs formWizSurvey os command injection5.3 Medium
- edimax ew-7438rpnEdimax EW-7438RPn webs formWpsStart os command injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formWlbasic command injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formWlanM system command injection5.3 Medium
- microsoft 365 copilot, 365 copilot for ios +1 moreMicrosoft Copilot Tampering Vulnerability9.3 Critical
- microsoft 365 copilotM365 Copilot Information Disclosure Vulnerability6.5 Medium
- microsoft power pagesMicrosoft Power Pages Remote Code Execution Vulnerability10.0 Critical
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`9.2 Critical
- zohocorp manageengine adselfservice plus, manageengine datasecurity plus, manageengine recoverymanager plus +2 moreRemote Code Execution8.4 High
- powerdns authoritativeInsufficient Validation of Names During AXFR6.8 Medium
- honeywell international inc. control network module (cnm)Improper sanitization9.1 Critical
- hp linux imaging and printing, hp inc linux imaging and printing software, hp, inc. hp linux imaging and printing software +15 more +17 moreHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution8.5 High
- dell smartfabric storage softwareDell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization...6.4 Medium
- mate-desktop atril, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +11 more +13 morePDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen8.4 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows BitLocker Security Feature Bypass Vulnerability6.8 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formStaDrvSetup command injection5.3 Medium
- edimax br-6228ncEdimax BR-6228NC POST Request mp command injection5.3 Medium
ngroknpmngrok is Vulnerable to Command Injection8.8 High- vercel aivercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection2.3 Low
- kalcaddle kodboxkalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection5.3 Medium
- vercel turborepo, turborepo language server protocol +1 moreTurborepo: VSCode Extension command injection8.4 High
- No product listedOinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands....7.3 High
- northern.tech cfengineNorthern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command...7.3 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP Privilege Escalation vulnerability8.5 High
- f5 big-ip, big-iq, big-ip access policy manager +21 more +23 moreiControl REST and TMSH vulnerability8.5 High
- f5 big-ip, big-ip domain name system +1 moreiControl REST and tmsh vulnerability8.5 High
- u-speed t18-21k firmwareU-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The...7.2 High
- efwgrp efw4.xefw4.X: RCE via zipslip9.3 Critical
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management Interface7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-107.2 High
- Show moreLoading…