CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection8.0 High
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro OS Command Injection9.0 Critical
- jmpsec osctrl`osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration7.4 High
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core has an OS Command Injection5.9 Medium
- z-libs zen-c, zenc-lang zen c +1 moreZen-C Vulnerable to Command Injection via Malicious Output Filename6.6 Medium
- linuxfoundation vitessVitess users with backup storage access can gain unauthorized access to production deployment environments8.4 High
- wp-graphqlWPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow7.7 High
- manyfoldManyfold vulnerable to OS command injection via ZIP filename in f3d render7.5 High
- maximmasiutin tinywebCGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)10.0 Critical
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick - Command Injection via SVG Decoder9.2 Critical
- cisco firepower extensible operating system (fxos), secure firewall adaptive security appliance (asa) software, unified computing system (managed) +2 moreCisco UCS Manager and FXOS Software Command Injection Vulnerability6.7 Medium
- hackerbay oneuptimeOneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()10.0 Critical
- linksys mr9600, mx4200 +1 moreMissing neutralization in Linksys MR9600, Linksys MX42009.8 Critical
- cisco unified computing system (managed)Cisco UCS Manager Software Command Injection Vulnerability6.5 Medium
- linksys mr9600, mx4200 +1 moreMissing neutralization in Linksys MR9600, Linksys MX42009.8 Critical
- olivetinOliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks10.0 Critical
- insat masterscada, masterscada buk-ts +1 moreInSAT MasterSCADA BUK-TS OS Command Injection9.3 Critical
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection8.7 High
- exiftool project exiftoolexiftool PNG File MacOS.pm SetMacOSTags os command injection5.3 Medium
- intelbras tip 635g, tip 635g firmware +1 moreIntelbras TIP 635G Ping os command injection5.3 Medium
- bleon-ethical api-gateway-deployapi-gateway-deploy Affected by Exploitable Command Injection via Unprivileged Root Execution9.2 Critical
- zyxel vmg3625-t50b firmware, dx5401-b1 firmware, emg3525-t50b firmware +3 more +5 moreA post-authentication command injection vulnerability in the TR-369 certificate download CGI...7.2 High
- zyxel ex3301-t0 firmware, am7510-00 firmware, ax7501-b1 firmware +49 more +51 moreA post-authentication command injection vulnerability in the log file download function of the...8.8 High
- zyxel ex3510-b0 firmware, dx4510-b0 firmware, dx4510-b1 firmware +15 more +17 moreA command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions...9.8 Critical
- yt-dlpyt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option8.8 High
- draytek vigor 300b, vigor300b firmware +1 moreDrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection5.1 Medium
- totolink x5000r firmwareTOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the...8.0 High
- totolink x6000r firmwareTOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the...8.8 High
- vaelsysVaelsys HTTP POST Request tree_server.php os command injection6.9 Medium
- tosei online store management system ネット店舗管理システム, tosei-corporation online store management system +1 moreTosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection6.9 Medium
- moodleMoodle: moodle: improper input sanitization in tex filter administration setting7.2 High
- kostasmitroglou thesystemthesystem 1.0 Command Injection via run_command endpoint9.3 Critical
- nagios host, xi +1 moreNagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability7.2 High
- Show moreLoading…