CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- dell openmanageDell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution...8.8 High
- yealink sip-t46uYealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection5.1 Medium
- yealink sip-t46uYealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection5.3 Medium
- cole aiosmtplibaiosmtplib: SMTP command injection via CR/LF in sender/recipient address6.9 Medium
opencpnUbuntuA code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to...7.8 High- ruijie eg105g-pRuijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection8.6 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection8.7 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection8.7 High
- filebrowserFile Browser: Command Allowlist Bypass via Shell Metacharacter Injection8.7 High
- openclawOpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution8.7 High
- kitty project kittyKitty has a shell command injection7.4 High
- roxy-wiRoxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save9.9 Critical
- ruby net-imapNet::IMAP: Command Injection via ID command argument5.8 Medium
- ruby net-imapNet::IMAP: Command Injection via non-synchronizing literal in "raw" argument5.8 Medium
degitnpmdegit has a Command Injection issue8.7 High- tenda f451Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection8.7 High
neovimDebianNeovim View Branch secure.lua M.read command injection4.8 Medium- foundationagents metagptFoundationAgents MetaGPT common.py check_cmd_exists command injection2.3 Low
- gl.inet gl-mt3000GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection6.9 Medium
- gl.inet gl-mt3000GL.iNet GL-MT3000 FTP Protocol glc snprintf command injection6.9 Medium
- gl.inet gl-mt3000GL.iNet GL-MT3000 Path Normalization dlopen command injection6.9 Medium
- gl.inet gl-mt3000GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection5.3 Medium
- gl.inet gl-mt3000GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection5.1 Medium
- gl.inet gl-mt3000GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection5.3 Medium
- vertex-app vertexvertex-app vertex Log Viewer Endpoint LogMod.js os command injection5.3 Medium
- gl.inet mt3000GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection5.3 Medium
- d-link dwr-m920D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection5.3 Medium
- dbgateDbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection9.4 Critical
- d-link dwr-m920, dlink dwr-m920 firmware +1 moreD-Link DWR-M920 formUSSDSetup sub_41CF20 command injection5.3 Medium
- d-link dwr-m920, dlink dwr-m920 firmware +1 moreD-Link DWR-M920 formSmsManage sub_41C8E8 command injection5.3 Medium
- shibby tomatoShibby Tomato Web UI rstats rstats_path os command injection8.6 High
- shibby tomatoShibby Tomato Web UI rc start_vpnserver os command injection8.6 High
- microsoft copilot, 365 copilot +1 moreMicrosoft M365 Copilot Remote Code Execution Vulnerability7.7 High
- microsoft copilot, 365 copilot +1 moreM365 Copilot Information Disclosure Vulnerability6.5 Medium
- shibby tomatoShibby Tomato Web UI rc start_6rd_tunnel os command injection8.6 High
- sepinetam stata-mcpMCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper9.3 Critical
- shibby tomatoShibby Tomato Web UI rc start_dhcpc os command injection8.6 High
- progress ecs connection manager, loadmaster, progress software moveit waf +4 more +6 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF9.6 Critical
- elunez eladminelunez eladmin Application Deployment App.java command injection5.3 Medium
- hiraishikentaro wezterm-mcphiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection5.3 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on Windows7.5 High
- No product listedphp-censor Webhook Endpoint GitBuild.php os command injection6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection6.9 Medium
- zhayujie chatgpt-on-wechatzhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection6.9 Medium
- trendnet tew-432brpTRENDnet TEW-432BRP formWlanSetup command injection5.3 Medium
- trendnet tew-432brpTRENDnet TEW-432BRP formSysCmd command injection5.3 Medium
- edimax br-6478acEdimax BR-6478AC POST Request formWlbasic command injection5.3 Medium
- edimax br-6478acEdimax BR-6478AC POST Request formStaDrvSetup command injection5.3 Medium
- dokployDokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline9.6 Critical
- Show moreLoading…