CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- moos-ivpMOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names9.3 Critical
- mit moos-ivpMOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS9.3 Critical
- d-link dns-320 sharecenterD-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection9.4 Critical
- d-link dns-340lD-Link DNS-340L CGI dropbox.cgi os command injection9.4 Critical
- d-link dns-340lD-Link DNS-340L Add-On Center addon_center.cgi os command injection9.4 Critical
- aws @amazon-codecatalyst/blueprints.blueprintOS command injection in the Amazon CodeCatalyst blueprints SDK8.5 High
- nousresearch hermes-agentHermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection8.6 High
- mongodb, mongodb for vs code +1 moreArbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal5.1 Medium
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization...5.0 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreArbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution8.4 High
- n8nn8n before 1.123.73 Remote Code Execution via Git Node7.7 High
- seppmail ag secure email gatewayOS command injection in privileged configuration handling8.6 High
- seppmail ag secure email gateway (seg)Unsafe deserialization in the REST interface8.6 High
- zhongbangkeji crmebZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection5.1 Medium
- nuclioNuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform8.7 High
- nuclioNuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)8.0 High
- as203038 looking-glassLooking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation9.8 Critical
- jenkins project tics pluginOS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers...7.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command injection in rpmuncompress via unescaped filenames passed to popen()7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path7.8 High
- coollabsio coolifyCoolify before 4.2.0 Remote Code Execution via Environment Variable Key8.7 High
- westermo weosWestermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.7.6 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 morePost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...7.8 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface7.2 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface8.8 High
- composerComposer: Perforce source URL permits P4PORT `rsh:` command execution7.7 High
- arubanetworks fabric composerAuthenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface7.2 High
- arubanetworks fabric composerAuthenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API7.2 High
- arubanetworks fabric composerUnauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface7.5 High
- arubanetworks fabric composerUnauthenticated Remote Code Execution in HPE Networking Fabric Composer7.5 High
- arubanetworks fabric composerUnauthenticated Remote Code Execution in HPE Networking Fabric Composer API8.1 High
- arubanetworks fabric composerUnauthenticated Remote Code Execution during HPE Networking Fabric Composer Installation Process8.3 High
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains an OS Command Injection vulnerability. An authenticated user with...8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames7.0 High
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains an OS Command Injection vulnerability. An authenticated user with...8.8 High
- schneider electric netbotz 5 - 750/755CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'...7.3 High
- librenmsLibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname8.6 High
- suse yast2-usersyast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute8.6 High
- pleskA critical local privilege escalation via OS command injection vulnerability has been discovered...9.0 Critical
- suse yast2-auth-clientyast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join8.7 High
- edimax br-6214kEdimax BR-6214K asp_setPing Endpoint ping.asp system os command injection5.1 Medium
- digitální a informační agentura (dia) eobčanka-identifikaceCommand Injection vulnerability in eObčanka-Identifikace9.3 Critical
- suse yast2-samba-clientyast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)7.5 High
- edimax br-6214kEdimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection5.1 Medium
- tubitak bilgem software technologies research institute pardus boot repairOS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair7.8 High
- d-link dns-340l, dns-345 +1 moreD-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection9.4 Critical
- d-link dns-320l, dns-327l, dns-340l +1 more +3 moreD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection9.4 Critical
- d-link dns-327l, dns-340l +1 moreD-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection9.4 Critical
- d-link dns-320l, dns-327l, dns-340l +1 more +3 moreD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection9.4 Critical
- d-link dns-340l, dns-345 +1 moreD-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection9.4 Critical
- Show moreLoading…