CWE-77 · Command Injection (page 10)
Page 10 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1910 | | 2025-12-04 | The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORIT… | |
CVE-2025-66404 | Medium | 6.4 | 2025-12-03 | MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_… |
CVE-2025-66032 | Critical | 9.8 | 2025-12-03 | Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass… |
CVE-2025-57201 | High | 8.8 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server fu… |
CVE-2025-57199 | High | 8.8 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetect… |
CVE-2025-57198 | High | 8.8 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the Machine.cgi e… |
CVE-2025-57200 | Medium | 6.5 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the test_mail fun… |
CVE-2025-65657 | Medium | 6.5 | 2025-12-02 | FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers… |
CVE-2025-66399 | High | 8.8 | 2025-12-02 | Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functio… |
CVE-2025-60854 | Critical | 9.8 | 2025-12-02 | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web a… |
CVE-2025-13800 | Medium | 6.3 | 2025-12-01 | A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation… |
CVE-2025-13799 | Medium | 6.3 | 2025-12-01 | A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The ma… |
CVE-2025-13798 | Medium | 6.3 | 2025-12-01 | A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the… |
CVE-2025-13797 | Medium | 6.3 | 2025-12-01 | A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Perform… |
CVE-2025-66219 | Critical | 9.8 | 2025-11-29 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitme… |
CVE-2025-63674 | Medium | 6.8 | 2025-11-24 | An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary code via overriding the bootloader on th… |
CVE-2025-11921 | | 2025-11-24 | iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iSt… | |
CVE-2025-13562 | High | 7.3 | 2025-11-23 | A vulnerability was identified in D-Link DIR-852 1.00. This issue affects some unknown processing of the file /gena.cgi. Such manipulation of the argument serv… |
CVE-2025-65946 | High | 8.1 | 2025-11-21 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo… |
CVE-2025-13442 | High | 7.3 | 2025-11-20 | A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdb… |
CVE-2025-37162 | Medium | 6.5 | 2025-11-18 | A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successfu… |
CVE-2025-63749 | Medium | 6.5 | 2025-11-18 | pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter. |
CVE-2025-37163 | High | 7.2 | 2025-11-18 | A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker cou… |
CVE-2025-63258 | Medium | 6.5 | 2025-11-18 | A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers and XiaoBei series routers, cloud gateways, and wireless acce… |
CVE-2025-63604 | Medium | 6.5 | 2025-11-18 | A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validatio… |
CVE-2025-63603 | Medium | 6.5 | 2025-11-18 | A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/… |
CVE-2025-13306 | Medium | 6.3 | 2025-11-18 | A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formD… |
CVE-2025-6945 | Low | 3.5 | 2025-11-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed… |
CVE-2025-60702 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` f… |
CVE-2025-63406 | High | 8.8 | 2025-11-13 | An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in… |
CVE-2025-60676 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSett… |
CVE-2025-60675 | Medium | 5.4 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which p… |
CVE-2025-60673 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDMZSettings… |
CVE-2025-60672 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSS… |
CVE-2025-60701 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_433188` func… |
CVE-2025-60700 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. The `sub_4455B… |
CVE-2025-60698 | High | 7.3 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` func… |
CVE-2025-60697 | High | 7.3 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` func… |
CVE-2025-60671 | Medium | 5.4 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which p… |
CVE-2025-60689 | Medium | 5.4 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001… |
CVE-2025-60687 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41… |
CVE-2025-60683 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4… |
CVE-2025-60682 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the… |
CVE-2025-46428 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vul… |
CVE-2025-46427 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vuln… |
CVE-2025-62222 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacke… |
CVE-2025-62214 | Medium | 6.7 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. |
CVE-2024-57695 | High | 7.7 | 2025-11-11 | An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock functio… |
CVE-2025-9223 | High | 8.8 | 2025-11-11 | Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper config… |
CVE-2025-63296 | Medium | 6.5 | 2025-11-10 | KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin… |
CVE-2025-12155 | | 2025-11-10 | A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission… | |
CVE-2025-12916 | Medium | 6.3 | 2025-11-09 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_lo… |
CVE-2025-46365 | Medium | 5.3 | 2025-11-05 | Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection… |
CVE-2024-51317 | Medium | 6.5 | 2025-11-03 | An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function |
CVE-2025-61141 | High | 7.5 | 2025-10-30 | sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and con… |
CVE-2025-60595 | High | 8.2 | 2025-10-29 | SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. |
CVE-2025-1549 | | 2025-10-29 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elev… | |
CVE-2025-12313 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipu… |
CVE-2025-12296 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handle… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-58428 | Critical | 9.9 | 2025-10-23 | The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attacker… |
CVE-2025-54964 | High | 8.4 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If… |
CVE-2025-41721 | Low | 2.7 | 2025-10-22 | A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a p… |
CVE-2025-56799 | Medium | 6.5 | 2025-10-21 | Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this… |
CVE-2025-57521 | Medium | 6.1 | 2025-10-21 | Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a netwo… |
CVE-2025-10020 | High | 8.5 | 2025-10-21 | Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component. |
CVE-2025-62696 | | 2025-10-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboar… | |
CVE-2025-57164 | Medium | 6.5 | 2025-10-17 | Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field. |
CVE-2025-61514 | Medium | 6.5 | 2025-10-16 | An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG fil… |
CVE-2025-60855 | Medium | 5.1 | 2025-10-16 | Reolink Video Doorbell WiFi DB_566128M5MP_W performs insufficient validation of firmware update signatures. This allows attackers to load malicious firmware im… |
CVE-2025-58132 | Medium | 4.1 | 2025-10-15 | Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
CVE-2025-34267 | Critical | 9.9 | 2025-10-14 | Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox… |
CVE-2025-37146 | High | 7.2 | 2025-10-14 | A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform re… |
CVE-2025-37138 | Medium | 6.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating sy… |
CVE-2025-37134 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37133 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-11665 | Medium | 4.7 | 2025-10-13 | A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler… |
CVE-2025-60838 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-60268 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadCon… |
CVE-2025-59286 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59272 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosur… |
CVE-2025-59252 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-56426 | Medium | 6.5 | 2025-10-09 | An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logi… |
CVE-2025-11523 | Medium | 6.3 | 2025-10-09 | A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argumen… |
CVE-2025-11491 | Medium | 6.3 | 2025-10-08 | A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager… |
CVE-2025-11490 | Medium | 6.3 | 2025-10-08 | A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/comman… |
CVE-2025-11488 | High | 7.3 | 2025-10-08 | A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command i… |
CVE-2025-61787 | High | 8.1 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when… |
CVE-2025-11407 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the arg… |
CVE-2025-11335 | Medium | 4.7 | 2025-10-06 | A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=q… |
CVE-2025-11331 | Medium | 4.7 | 2025-10-06 | A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Webs… |
CVE-2025-11303 | Medium | 6.3 | 2025-10-05 | A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing a manipulation of the argument comma… |
CVE-2025-11298 | Medium | 6.3 | 2025-10-05 | A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the… |
CVE-2025-11292 | Medium | 6.3 | 2025-10-05 | A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing a manipulation of… |
CVE-2025-11285 | Medium | 6.3 | 2025-10-05 | A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController… |
CVE-2025-59741 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59740 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59739 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59738 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59737 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |