CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- h3c nx15H3C NX15 esps delete command injection8.6 High
- h3c nx15H3C NX15 esps esps.ipv6.wan command injection8.6 High
- h3c nx15H3C NX15 esps add command injection8.6 High
- belkin ax1800GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection8.7 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection9.3 Critical
- No product listedH3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010...9.8 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 modem.so glc set_upgrade command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 modem.so glc remove_profile command injection9.3 Critical
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection6.9 Medium
- gl-inet gl-mt3000GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection8.7 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection8.6 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection8.7 High
- wavlink wl-nu516u1Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection5.3 Medium
- wavlink wl-nu516u1Wavlink WL-NU516U1 Config Import os command injection7.7 High
- advantech adam-3600Successful exploitation of the command injection vulnerability could allow an attacker to execute...8.6 High
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- No product listedTR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in...7.2 High
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreCommand Injection in SCM (idledisconnect parameter)9.3 Critical
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- No product listedAn issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the...9.8 Critical
- kube-logging logging-operatorLogging operator has Fluentd configuration injection that allows remote code execution9.9 Critical
- calcom cal.diycal.com Repository Takeover via pull_request_target Workflow8.5 High
- localstack serverless-localstacklocalstack serverless-localstack Configuration index.js os command injection4.8 Medium
- conventional-changelogrelease-it conventional-changelog Changelog File index.js writeChangelog os command injection4.8 Medium
- bahmutov find-cypress-specsbahmutov find-cypress-specs Branch index.js shell.exec os command injection4.8 Medium
- No product listedpublint package-manager pack.js child_process.exec os command injection4.8 Medium
- syncfusion ej2-javascript-ui-controlssyncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection4.8 Medium
- danger danger-jsdanger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection4.8 Medium
- No product listedoclif JIT Plugin Entry child_process.exec os command injection4.8 Medium
- umijs umiumijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection5.1 Medium
- No product listedjsforce SFDX Connection Registry sfdx.js _execCommand os command injection4.8 Medium
- qusetions minicode-pythonQUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection2.3 Low
- jetbrains hubMeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow7.5 High
- hewlett packard enterprise (hpe) edgeconnect sd-wan gateway (ecos)Authenticated Command Injection allows arbitrary command execution in CLI Interface7.2 High
- gitpython-developers gitpythonGitPython before 3.1.51 Command Injection via unguarded Git options8.6 High
- d-link dnr-202l, dnr-322l, dnr-326 +17 more +19 moreD-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection5.3 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: information disclosure via proxycommand %r username expansion3.9 Low
- liumengxuan04 minicodeLiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection2.3 Low
- No product listedAn issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute...9.1 Critical
- langbot-app langbotLangBot: Authenticated RCE Via MCP Configuration8.8 High
- eugeny tabbyTabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)7.8 High
- No product listedLiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation...9.8 Critical
- Show moreLoading…