CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
gpt-researcherPyPIGPT Researcher MCP STDIO configuration allows remote command execution9.8 Critical- microsoft windows admin centerWindows Admin Center (WAC) Remote Code Execution Vulnerability8.8 High
- microsoft copilotOutlook Copilot Tampering Vulnerability6.3 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows server 2025 +3 more +5 moreClipboard User Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Narrator Braille Elevation of Privilege Vulnerability7.8 High
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability8.4 High
- microsoft 365 copilot, edge copilot for android, edge copilot for ios +2 moreMicrosoft Edge Copilot Remote Code Execution Vulnerability9.6 Critical
- louisho5 picobotlouisho5 picobot exec Tool exec.go ExecTool.Execute os command injection4.8 Medium
- evbee dc-80Command injection in NPC start web endpoint9.3 Critical
- evbee dc-80Command injection in diagnosis web endpoint9.3 Critical
- shibby tomatoShibby Tomato CIFS Mount sub_2D048 os command injection5.3 Medium
- shibby tomatoShibby Tomato start_jffs2 sub_2D568 os command injection5.3 Medium
- wavlink wl-nu516u1Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection5.3 Medium
- comfast cf-wr631ax v3Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection9.3 Critical
- soniccloudorg sonic-agentSonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection5.3 Medium
- soniccloudorg sonic-agentSonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection5.3 Medium
- trendnet tew-821dapTRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injection5.3 Medium
- trendnet tew-821dapTRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injection5.3 Medium
- trendnet tew-821dapTRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection5.3 Medium
- trendnet tew-635brmTrendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection8.7 High
- tigroumeow code engine – php snippets, ai functions & automation for wordpressCode Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution8.8 High
- stefanzweifel laravel-backup-restorewnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injec…8.0 High
- hoppscotchHoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection7.2 High
- aidanpark openclaw-androidAidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection4.8 Medium
- bentoml openllmbentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection4.8 Medium
- christopherthielen check-peer-dependencieschristopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection5.3 Medium
- react create-react-appreact create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection6.9 Medium
- ubiquiti inc cloud gateways, cloud keys, dream machines +40 more +42 moreA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- databasebackup wp database backup – unlimited database & files backup by backup for wpWP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter7.2 High
- No product listedAn unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set...6.5 Medium
- edimax ew-7478apcEdimax EW-7478APC POST Request formStaDrvSetup os command injection5.3 Medium
- edimax ew-7478apcEdimax EW-7478APC POST Request formiNICbasic os command injection5.3 Medium
- edimax ew-7478apcEdimax EW-7478APC POST Request formAccept os command injection5.3 Medium
- d-link dcs-935l, dlink dcs-935l firmware +1 moreD-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection8.7 High
- wavlink wl-nu516u1-aWavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection5.3 Medium
- antlr antlr4antlr ANTLR4 gofmt GoTarget.java GoTarget command injection4.8 Medium
- vimVim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction6.5 Medium
- gogsGogs: RCE via git rebase --exec argument injection in pull request merge9.9 Critical
- coollabsio coolifycoollabsio coolify Image Name os command injection5.3 Medium
- comfast cf-wr631ax v3Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request mp command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request stainfo command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request setWAN command injection5.3 Medium
- microsoft 365 copilotMicrosoft Copilot Tampering Vulnerability6.5 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution9.4 Critical
- mervinpraison praisonaiagentsPraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters8.1 High
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- Show moreLoading…