CWE-77: Command injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in a Command.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- continuedev continuecontinuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection5.3 Medium
- quantgeekdev docker-mcpQuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection5.3 Medium
- dbcli myclidbcli mycli Whitelist source.py source_special_command_is_safe os command injection4.8 Medium
- unitree robotics go2, unitreerobotics unitree go2 +1 moreUnitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection9.4 Critical
- travisun opptrixTravisun Opptrix Schedule API setup command injection6.9 Medium
@rog0x/mcp-docker-toolsnpm@rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function7.5 High@rog0x/mcp-git-toolsnpm@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function7.5 High- microsoft azure pipelinesAzure Pipelines Remote Code Execution Vulnerability9.1 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface6.8 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated Command Injection Vulnerabilities in AOS-107.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated File Write leads to Command Injection Vulnerabilities in AOS-107.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated Command Injection Vulnerabilities in AOS-87.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated Command Injection Vulnerabilities in AOS-87.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Improper Sanitization leads to Command Injection in AOS-8 Web Interface7.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol8.1 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-108.3 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol8.8 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Adjacent Command Injection Vulnerability in AOS-109.6 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-109.8 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol9.8 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Command Injection Vulnerabilities in AOS-810.0 Critical
- totolink a950rgTOTOLINK A950RG product.so UploadCustomModule command injection10.0 Critical
- No product listedaaPanel File Manager common.py ExecShell os command injection9.4 Critical
- vitejs launch-editor, vite, vite-plus +2 morelaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows7.5 High
- draytek vigor2960DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection5.3 Medium
- draytek vigor2960DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection5.3 Medium
- draytek vigor2960DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection9.4 Critical
- draytek vigor2960DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection9.4 Critical
- draytek vigor2960DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection9.4 Critical
- mcollina mcp-ripgrepmcollina mcp-ripgrep Advanced Search Tool index.ts os command injection4.8 Medium
- advantech adam-3600A command injection vulnerability could allow an authenticated attacker to achieve root-level...8.6 High
- advantech adam-3600A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with...9.3 Critical
- h3c magic nx15H3C Magic NX15 usrlist sub_416874 os command injection9.4 Critical
- orbitale imagemagick-phporbitale imagemagick-php Command.php font os command injection6.9 Medium
- fusionpbxFusionPBX Dialplan Editor dialplan.php os command injection5.1 Medium
- jumpserverJumpServer Template Rendering os command injection5.1 Medium
- alexpasmantier televisionalexpasmantier television entry.rs output command injection4.8 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action8.8 High
- wavlink wl-wn530be2-aWavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection10.0 Critical
- jxxghp moviepilotMoviePilot 3.1.5 Command Injection via ExecuteCommandTool8.7 High
- d-link dir-868lD-Link DIR-868L HNAP CGI cgibin system os command injection10.0 Critical
- dell unisphere for powermax vappDell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of...6.6 Medium
- microsoft 365 apps, 365 apps for enterprise +1 moreMicrosoft Office OneNote Remote Code Execution Vulnerability8.8 High
- microsoft windows, edge (chromium-based), outlook.com +29 more +31 moreWindows Shell Security Feature Bypass Vulnerability8.8 High
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +9 more +11 moreWindows Update Elevation of Privilege Vulnerability7.8 High
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability8.8 High
- hbai-ltd toonflow-appHBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection4.8 Medium
- wavlink wl-wn592ax6Wavlink WL-WN592AX6 wmapd system os command injection10.0 Critical
- wavlink wl-wn530be1-aWavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection9.4 Critical
- No product listedMobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, ...9.8 Critical
- Show moreLoading…