CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- cisco identity services engine softwareCisco Identity Services Engine IPSec Open API Command Injection Vulnerability6.5 Medium
- cisco thousandeyes enterprise agentCisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability4.7 Medium
- hp linux imaging and printing, hp inc. linux imaging and printing software (hplip) +1 moreHP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities8.4 High
- hp linux imaging and printing, hp inc. linux imaging and printing software (hplip) +1 moreHP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities6.8 Medium
- cisco identity services engine software, ise passive identity connector +1 moreCisco Identity Services Engine Command Injection Vulnerability9.1 Critical
- cisco identity services engine software, ise passive identity connector +1 moreCisco Identity Services Engine Command Injection Vulnerability9.1 Critical
- sshnet ssh.netSSH.NET: ScpClient allows server-side RCE via default SCP path handling7.5 High
- dell update package frameworkDell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of...7.3 High
- ruijie rg-ew3000gxRuijie RG-EW3000GX user_list_note admin os command injection9.4 Critical
- ruijie rg-ew3000gxRuijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection9.4 Critical
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- advantech eki-1242eims, eki-1242ieims +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- wnc t-mobile 5g box iduAuthorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers9.3 Critical
- wnc t-mobile 5g box iduUnauthorized remote code execution in T-Mobile 5G Box IDU routers9.4 Critical
- wnc t-mobile 5g box iduCommand Injection in T-Mobile 5G Box IDU router via ping functionality9.3 Critical
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreRemote code execution via uploading a malicious IODD file9.8 Critical
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection via PUT in /api/datastorage/data7.2 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection via GET in /api/datastorage/data7.2 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection via PUT in /api/iodd/config7.2 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection via GET in /api/iodd/config7.2 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection via DELETE in /api/status/data7.2 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection via GET in /api/status/data8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in /index.php/ajax/save_iodd_parameters8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in /index.php/ajax/parameterManage8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in Field_Shadow_Password Class8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in /index.php/attached_devices_tab/do_upload8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in /index.php/ajax/get_iodd_port_info8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreCommand Injection in /index.php/ajax/get_iodd_menu_info8.8 High
- arista networks eosSecurity Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request9.4 Critical
- arista networks velocloud edgeSecurity Advisory 01817.5 High
- web-infra-dev rsbuildRsbuild < 2.0.9 Command Injection via openBrowser() URL Handling7.1 High
- hewlett packard enterprise (hpe) edgeconnect sd-wan gateways, arubanetworks edgeconnect sd-wan orchestrator, hpe edgeconnect operating system +2 moreAuthenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways7.2 High
- totolink x5000rTOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection5.3 Medium
- flowiseai flowiseFlowise before 3.1.4 Script Injection via Docker Workflows8.3 High
- flowiseai flowiseFlowise before 3.1.4 Remote Code Execution via Custom MCP npx9.0 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreEnvironment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters7.3 High
- trexom trxtimeattendanceArbitrary command execution in TrxTimeATTENDANCE9.3 Critical
- wso2 integrator: mi for visual studio codeOS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution7.0 High
- lite-on technology corporation ff-rfi078i4, ff-rfi079i4 +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- efm iptime c200eEFM ipTIME C200E System Setup iux_set.cgi os command injection9.4 Critical
- sabyasachirana webmapSabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection6.9 Medium
- No product listedAn issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to...8.8 High
- ibm i access familyIBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities6.3 Medium
- ibm i access familyIBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities6.3 Medium
- ibm i access familyIBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities6.3 Medium
- Show moreLoading…