CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller OS Command Injection8.7 High
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller OS Command Injection9.4 Critical
- signalk signal k server, signalk-server +1 moreSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)9.7 Critical
- infiniflow ragflowRAGFlow Remote Code Execution Vulnerability8.6 High
- gargoyle router management utility, gargoyle-router gargoyle +1 moreGargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh8.7 High
- meternmeterN 1.2.3 Authenticated Remote Code Execution via Admin Scripts8.6 High
- cypress 200Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection via Firmware Upgrade8.6 High
- qno technology vpn firewallQNO Technology｜VPN Firewall - OS Command Injection8.7 High
- qno technology vpn firewallQNO Technology｜VPN Firewall - OS Command Injection8.7 High
- ateme flamingo xl, flamingo xl firmware +1 moreAnevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command8.6 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php8.5 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.php8.7 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.php8.5 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php8.5 High
- minidvblinuxMiniDVBLinux 5.4 Remote Root Command Execution via commands.sh9.3 Critical
- tenda w6-s, w6-s firmware +1 moreTenda W6-S ATE Service ate TendaAte os command injection5.3 Medium
- lemon8866 streamvaultStreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection10.0 Critical
- openopsOpenOps before 0.6.11 allows remote code execution in the Terraform block.7.4 High
- videoflow ltd. digital video protection dvpVideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution8.7 High
- iwt facesentry access control system firmware, iwt ltd. facesentry access control system +1 moreFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test8.7 High
- microhard systems 3g/4g cellular ethernet and serial gateway backdoor jailbreak, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Backdoor Jailbreak via Microhard Sh Service8.7 High
- johnson controls istar ultra g2, istar ultra g2 se, istar edge g2, istar ultra, istar ultra se +1 moreiSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings8.7 High
- johnson controls istar ultra g2, istar ultra g2 se, istar edge g2, istar ultra, istar ultra se +1 moreiSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo8.7 High
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path9.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename9.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename9.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import9.4 Critical
- dreamfactoryDreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability7.2 High
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup10.0 Critical
- icewarpIceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability9.8 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection9.3 Critical
- thibaud-rohmer photoshowPhotoShow 3.0 Remote Code Execution via Exiftran Path Injection8.6 High
- cat03 lilac-reloadedLilac-Reloaded for Nagios 2.0.8 Remote Code Execution via Autodiscovery9.3 Critical
- brainycpBrainyCP 1.0 Remote Code Execution via Authenticated Crontab Manipulation8.7 High
- mitsubishi electric corporation genesis64, iconics suite, mc works64 +1 more +3 moreMalicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works648.2 High
- easyphp webserverEasyPHP Webserver 14.1 Remote Code Execution9.3 Critical
- tp-link systems inc. wa850re, tp-link tl-wa850re firmware +1 moreCommand Injection Vulnerability in TP-Link WA850RE7.1 High
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreOS Command Injection in WODESYS WD-R608U router9.4 Critical
- ruijie networks co., ltd. ap180(ja) v1.xx, ap180(ja) v2.xx, ap180(jp) v1.xx +6 more +8 moreRG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd....8.6 High
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionality9.1 Critical
- johnson control istar ultra, istar ultra se, istar ultra g2, istar ultra g2 se, istar edge g2iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce8.7 High
- ritecmsRiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE)...7.2 High
- pagekitPagekit CMS is vulnerable to OS Command Injection via Storage component9.9 Critical
- sebhildebrandt systeminformationCommand Injection in fsSize() on Windows8.1 High
- wavestore server, video management software server +1 moreOS Command Injection via Path Traversal in WaveStore Server8.6 High
- allskyteam allskyA Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an...10.0 Critical
- wp2facWp2Fac 1.0 OS Command Injection via send.php Endpoint9.3 Critical
- totolink x5000r, x5000r firmware +1 moreTOTOLINK X5000R cstecgi.cgi snprintf os command injection5.3 Medium
- atcom technology co., ltd. 100m ip phonesAtcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI8.7 High
- Show moreLoading…