CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- tr7 cyber defense inc. aspOS Command in TR7 Cyber Defense's TR7 ASP9.8 Critical
- hewlett packard enterprise hpe nonstop java jtoolkitHPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability3.8 Low
- koha community kohaKoha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task8.8 High
- e-guardian siteguard, eg secure solutions siteguard server edition, eg secure solutions inc. siteguard server edition for apache httpd +4 more +6 moreSiteGuard Server Edition contains an OS command injection vulnerability, which may allow an...8.5 High
- netbirdNetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution8.9 High
- collabora online - built-in code server, online – built-in code server +1 moreCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app,...9.2 Critical
- samsung open source qa-boardSamsung QA-Board — Unauthenticated OS command injection via output redo/tuning9.8 Critical
- akamai guardicore platform agentThe Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege...6.7 Medium
- citrix uniconosPersistent Command Execution6.9 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +2 moreAdobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)9.9 Critical
- komodoMoghtech Komodo contains an OS command injection vulnerability8.8 High
- vnotex vnoteVNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling7.0 High
- folkertvanheusden multitailMultiTail: Shell injection in execute-on-match command handling7.3 High
- microsoft azure cyclecloud 8.9.1Azure CycleCloud Remote Code Execution Vulnerability7.3 High
- kde dolphinKDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name7.1 High
- nspc911 rovrrovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe8.4 High
- fortinet fortimanager, fortimanager cloud +1 moreA improper neutralization of special elements used in an os command ('os command injection')...5.3 Medium
- odt2spipodt2spip < 4.4.0 OS Command Injection via Document Filename8.7 High
- heymrun heymheym Python Tool Sandbox Escape8.8 High
- commvault cloud, grid(hsx) cvfs +1 moreCVFS Command Execution9.3 Critical
- wavlink wl-wn592ax6Wavlink WL-WN592AX6 wmapd system os command injection10.0 Critical
- wavlink wl-wn530be1-aWavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection9.4 Critical
- cap, teltonika networks atrm, dap +11 more +13 moreTeltonika Command Injection in Backup function8.5 High
- sap se yeoman-uiOS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code5.9 Medium
- No product listedreNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99)...9.8 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Command Injection8.8 High
- ibm maximo application suite - location service for esri componentIBM Maximo Application Suite - Location Service for Esri Component Code Execution8.7 High
- rvc-boss gpt-sovitsGPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py9.3 Critical
- karuppiah7890 easy-pdf-mergeeasy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function9.2 Critical
- trilbymedia grav-plugin-git-syncGrav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author8.7 High
- linksys e1700Linksys E1700 setLinksysIpv6 os command injection9.4 Critical
- linksys e1700Linksys E1700 setDMZ os command injection9.4 Critical
- linksys e1700Linksys E1700 Static Route addStaticRoute os command injection9.4 Critical
- ministry of justice uyap document editorCommand Injection in Ministry of Justice's UYAP Document Editor7.8 High
- cfdude mac-shell-mcpmac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments8.5 High
- dassault systèmes tuleap enterprise editionOS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.58.8 High
- agnoagno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection5.1 Medium
- trendnet tew-751dr, tew-752dru, tew733gr +2 moreTRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection10.0 Critical
- minasaad1 pbi-clipbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync7.3 High
- safecam x300TOZED X300 IPPingDiagnostics process_ping os command injection10.0 Critical
- openspug spugOpenSpug File Transfer transfer os command injection9.4 Critical
- spotwebSpotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration7.7 High
- fusionpbxFusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download7.7 High
- cellhubs exiftool for photo and videoExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export8.4 High
- argoproj argo-cdArgo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL8.8 High
- No product listedAn issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114...9.8 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- dromara skyeyeDromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter9.3 Critical
- tenable, inc. tenable identity exposure (saas)Command Injection9.4 Critical
- ibm guardium data protectionIBM Guardium Data Protection Command Injection7.2 High
- Show moreLoading…