CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- fortinet fortiextender, fortiextender firmware +1 moreA improper neutralization of special elements used in an os command ('os command injection') in...6.7 Medium
- argoproj argo-workflows, argo workflows +1 moreargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links8.1 High
- openmptcprouterAn issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade...9.8 Critical
- tykodev cherry-studio-tykoforkTykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injection5.3 Medium
- request serious play llc serious play, serious play pro +1 moreReQuest Serious Play F3 Media Server <= 7.0.3 code execution9.3 Critical
- edimax br-6478ac v3, br-6478ac v3 firmware +1 moreEdimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection5.1 Medium
- edimax br-6478ac v3, br-6478ac v3 firmware +1 moreEdimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection5.1 Medium
- edimax br-6478ac v3, br-6478ac v3 firmware +1 moreEdimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection5.1 Medium
- array networks arrayos agArray Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in...7.2 High
- remotecontrolio remote keyboard desktopRemote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)8.9 High
- loadedcommerce loaded commerceLoaded Commerce 6.6 Client-Side Template Injection (CSTI)6.9 Medium
- indigostar software perl2exeIndigoSTAR Software - perl2exe <= V30.10C - Arbitrary Code Execution8.5 High
- allnet all-rut22gw firmwareALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the...9.8 Critical
- collabora online - built-in code server, collaboraonline online +1 moreConfiguration-Dependent RCE (OS Command Injection) in richdocumentscode proxy7.2 High
- totolink n300rtTOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE9.3 Critical
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 moreAbrt: command-injection in abrt leading to local privilege escalation8.8 High
- sge-plc1000 sge-plc50 circutor, circutor sge-plc1000 firmware, sge-plc50 firmware +2 moreCommand injection vulnerability in Circutor SGE-PLC1000/SGE-PLC508.5 High
- kapilduraphe mcp watch, mcp-watch +1 moreMCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL9.8 Critical
- 0x4m4 hexstrike aiHexStrike AI MCP Server Command Injection9.1 Critical
- sdmc ne6037Authenticated RCE in SDMC NE6037 router9.3 Critical
- zenitel tciv-3+Zenitel TCIV-3+ OS Command Injection10.0 Critical
- zenitel tciv-3+Zenitel TCIV-3+ OS Command Injection10.0 Critical
- zenitel tciv-3+Zenitel TCIV-3+ OS Command Injection10.0 Critical
- cursorImproper neutralization of special elements used in an OS command ('command injection') in Cursor...9.8 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated OS Command Injection (restore_settings.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated OS Command Injection (start_upgrade.php)9.9 Critical
- trendnet tew-657brm firmwareTRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the...8.0 High
- fugue-project fugueFugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer8.8 High
- asus routerA command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker...7.5 High
- asus routerAn authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by...9.2 Critical
- google cloud lookerRemote Code Execution in Looker via Teradata JDBC Driver7.5 High
- shenzhen tvt digital technology co., ltd. nvms-9000TVT NVMS-9000 Hard-coded API Credentials & Command Injection9.3 Critical
- opto22 groov rio grv-r7-i1vapm-3, groov rio grv-r7-mm1001-10, groov rio grv-r7-mm2001-10 +2 more +4 moreCommand Injection in Opto22 Groov REST API7.5 High
- anthropic claude code, anthropics claude-code +1 more@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes8.7 High
- lite xl xl, lite-xl lite xl +1 moreCVE-2025-121217.3 High
- ilevia eve x1 server firmwareAn issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 -...9.8 Critical
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.php8.7 High
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE8.7 High
- dlink dir-868l firmwareD-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution...7.3 High
- arubanetworks airwave, hewlett packard enterprise (hpe) hpe aruba networking management software (airwave) +1 moreAuthenticated Command Injection Vulnerability in HPE Aruba Networking Management Software (AirWave) CLI7.2 High
- hewlett packard enterprise (hpe) hpe aruba networking aos-cx, hpe arubaos-cx +1 moreAuthenticated Command Injection allows Unauthorized Command Execution in AOS-CX6.7 Medium
- hewlett packard enterprise (hpe) hpe aruba networkign aos-cx, hpe arubaos-cx +1 moreAuthenticated Command Injection allows Unauthorized Command Execution in AOS-CX6.7 Medium
- fortinet fortiwebAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...6.7 Medium
- zyxel dx3300-t0 firmware, ax7501-b0 firmware, ax7501-b1 firmware +51 more +53 moreA post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0...8.8 High
- ispyconnect agent dvrLocal Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an...7.8 High
- d-link dir-822k, dir-825m, dwr-m920 +5 more +7 moreD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection5.3 Medium
- nagios log serverNagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries8.6 High
- isaacs glob, node-glob +1 moreglob CLI: Command injection via -c/--cmd executes matches with shell:true7.5 High
- maxum rumpus, pcman ftp server +1 moreCWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')6.8 Medium
- thinplusThinPLUS｜ThinPLUS - OS Command Injection9.3 Critical
- Show moreLoading…