CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- tp-link systems inc. archer be3600 v1Command Injection in Parent Control of TP-Link Archer BE3600 v18.5 High
- tp-link systems inc. archer be800 v1Command Injection Vulnerability in VPN connection of Archer BE8008.5 High
- tp-link systems inc. archer be800 v1, archer ax75 v1, archer be3600 v1 +2 moreCommand Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices8.7 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via setTime8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via setDevice8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via getDetail8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via getVid8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via auth_set8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi9.3 Critical
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via commandTable8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm9.3 Critical
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via apautotest8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via InquierTime8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via setcamset8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via setLan8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via ExportSettings8.6 High
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform8.6 High
- black duck blackduck-c-cppImproper Neutralization of Special Elements used in an OS Command in the package manager...7.5 High
- sakura editor development community editorSakura Editor provided by Sakura Editor Development Community contains an OS command injection...8.4 High
- 4mosan security technology gcb doctor4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection9.3 Critical
- tanstack devtools-viteTanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection2.0 Low
- jeemok better-npm-auditbetter-npm-audit OS Command Injection via registry flag8.5 High
- tclahr uacUAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh8.5 High
- tclahr uacUAC < 3.3.0 Command Injection via command_collector.sh8.5 High
- tclahr uacUAC < 3.3.0 Command Injection via run_command.sh8.5 High
- apache cloudstackApache CloudStack: OS Command Injection due to unsanitized mount command8.8 High
- apache cloudstackApache CloudStack: RCE and SSRF in direct download, metalink and NFS templates8.8 High
- datiphy inc. data management centerDatiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command9.4 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.9 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.4 High
- centuran consulting otrs community editionOTRS Community Edition OS Command Injection via PGP Configuration8.6 High
- laravel-backpack crudbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)8.1 High
- merit lilin v1, tp-link dr3150 firmware, dr3220v-4g firmware +34 more +36 morePre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways9.3 Critical
- sony xav-9500esSony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability7.8 High
- kenwood dnr1007xrKenwood DNR1007XR startUpdateProcess Command Injection Vulnerability6.8 Medium
- kenwood dnr1007xrKenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability7.0 High
- nomachineNoMachine getstat Command Injection Remote Code Execution Vulnerability8.8 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.8 High
- klarso gmbh neo-mjsCVE-2026-184829.8 Critical
- Show moreLoading…