CWE-77 · Command Injection (page 11)
Page 11 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56425 | Critical | 9.1 | 2026-01-08 | An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earl… |
CVE-2025-55125 | High | 7.8 | 2026-01-08 | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file. |
CVE-2025-67089 | High | 8.1 | 2026-01-08 | A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC me… |
CVE-2025-61492 | Critical | 10.0 | 2026-01-07 | A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted… |
CVE-2025-61489 | Medium | 6.5 | 2026-01-07 | A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafte… |
CVE-2025-15472 | High | 7.2 | 2026-01-07 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation… |
CVE-2025-15471 | Critical | 9.8 | 2026-01-07 | A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the ar… |
CVE-2026-0641 | Medium | 6.3 | 2026-01-06 | A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi… |
CVE-2025-64424 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64419 | Critical | 9.6 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from doc… |
CVE-2025-67397 | Critical | 9.1 | 2026-01-05 | An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection. |
CVE-2026-0581 | Medium | 6.3 | 2026-01-05 | A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of t… |
CVE-2025-15391 | Medium | 6.3 | 2025-12-31 | A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation caus… |
CVE-2025-15357 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument… |
CVE-2025-69256 | High | 7.5 | 2025-12-30 | The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to ve… |
CVE-2025-15257 | High | 7.3 | 2025-12-30 | A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of th… |
CVE-2025-15256 | High | 7.3 | 2025-12-30 | A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web… |
CVE-2025-15254 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a man… |
CVE-2025-69201 | Critical | 9.8 | 2025-12-29 | Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent… |
CVE-2025-15192 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgr… |
CVE-2025-15191 | Medium | 6.3 | 2025-12-29 | A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom… |
CVE-2025-15139 | Medium | 6.3 | 2025-12-28 | A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Such manipulation of… |
CVE-2025-15137 | High | 8.8 | 2025-12-28 | A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manip… |
CVE-2025-15136 | High | 8.8 | 2025-12-28 | A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the compon… |
CVE-2025-15133 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the… |
CVE-2025-15132 | Medium | 6.3 | 2025-12-28 | A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the compon… |
CVE-2025-15131 | Medium | 6.3 | 2025-12-28 | A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP… |
CVE-2025-66738 | High | 8.8 | 2025-12-26 | An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of th… |
CVE-2025-65885 | Medium | 5.1 | 2025-12-26 | An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (De… |
CVE-2025-15081 | Medium | 6.3 | 2025-12-25 | A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument… |
CVE-2025-15048 | High | 7.3 | 2025-12-23 | A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler… |
CVE-2025-25364 | High | 8.4 | 2025-12-23 | A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary command… |
CVE-2025-29229 | Critical | 9.8 | 2025-12-23 | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. |
CVE-2025-29228 | Critical | 9.8 | 2025-12-23 | Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter. |
CVE-2025-50526 | Critical | 9.8 | 2025-12-23 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function. |
CVE-2025-45493 | Medium | 6.5 | 2025-12-23 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function. |
CVE-2025-67436 | Medium | 6.5 | 2025-12-22 | Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a the… |
CVE-2025-14884 | High | 7.2 | 2025-12-18 | A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Perform… |
CVE-2025-68433 | High | 7.7 | 2025-12-17 | Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configuratio… |
CVE-2025-68432 | High | 7.7 | 2025-12-17 | Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurat… |
CVE-2024-46062 | High | 7.8 | 2025-12-17 | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During instal… |
CVE-2024-46060 | High | 7.8 | 2025-12-17 | Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During install… |
CVE-2025-55901 | Medium | 6.5 | 2025-12-15 | TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter. |
CVE-2025-55893 | Medium | 6.5 | 2025-12-15 | TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName. |
CVE-2025-14707 | Critical | 9.8 | 2025-12-15 | A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component D… |
CVE-2025-14706 | Critical | 9.8 | 2025-12-15 | A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETRE… |
CVE-2025-14705 | Critical | 9.8 | 2025-12-15 | A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the… |
CVE-2025-14659 | High | 8.8 | 2025-12-14 | A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown function of the component DHCP Daemon. The manipulation… |
CVE-2025-14648 | Medium | 4.7 | 2025-12-14 | A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalog_ad… |
CVE-2025-14586 | Medium | 6.3 | 2025-12-13 | A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?acti… |
CVE-2025-67728 | Critical | 9.8 | 2025-12-12 | Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads… |
CVE-2025-67508 | High | 8.4 | 2025-12-12 | gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish… |
CVE-2025-64993 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Imprope… |
CVE-2025-64992 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25… |
CVE-2025-64991 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Impr… |
CVE-2025-64988 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V1… |
CVE-2025-64987 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction… |
CVE-2025-64986 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort ins… |
CVE-2025-14485 | Medium | 5.0 | 2025-12-11 | A weakness has been identified in EFM ipTIME A3004T 14.19.0. This vulnerability affects the function show_debug_screen of the file /sess-bin/timepro.cgi of the… |
CVE-2025-67511 | Critical | 9.6 | 2025-12-11 | Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulne… |
CVE-2025-65293 | Medium | 6.6 | 2025-12-10 | Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR cod… |
CVE-2025-65292 | High | 7.3 | 2025-12-10 | Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute a… |
CVE-2025-64671 | High | 8.4 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally. |
CVE-2025-54100 | High | 7.8 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code local… |
CVE-2025-40937 | High | 8.3 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST… |
CVE-2024-56837 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56836 | High | 7.5 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-14276 | Medium | 5.6 | 2025-12-08 | A vulnerability was determined in Ilevia EVE X1 Server up to 4.6.5.0.eden. Impacted is an unknown function of the file /ajax/php/leaf_search.php. This manipula… |
CVE-2025-65363 | High | 7.2 | 2025-12-08 | Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabli… |
CVE-2025-14225 | Medium | 6.3 | 2025-12-08 | A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipul… |
CVE-2025-14208 | Medium | 6.3 | 2025-12-08 | A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub_415028 of the file /goform/set_wan_settings. The manipulat… |
CVE-2025-14204 | Medium | 6.3 | 2025-12-07 | A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-au… |
CVE-2025-14188 | High | 7.2 | 2025-12-07 | A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handler_file_backup_create of the file /v1/file/back… |
CVE-2025-14184 | Medium | 6.3 | 2025-12-07 | A vulnerability was determined in SGAI Space1 NAS N1211DS up to 1.0.915. Impacted is the function RENAME_FILE/OPERATE_FILE/NGNIX_UPLOAD of the file /cgi-bin/JS… |
CVE-2025-14108 | High | 8.8 | 2025-12-05 | A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open… |
CVE-2025-14107 | High | 8.8 | 2025-12-05 | A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/… |
CVE-2025-14106 | High | 8.8 | 2025-12-05 | A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the compo… |
CVE-2025-14094 | Medium | 4.7 | 2025-12-05 | A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the a… |
CVE-2025-14093 | Medium | 4.7 | 2025-12-05 | A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulati… |
CVE-2025-64052 | Medium | 5.1 | 2025-12-05 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands. |
CVE-2025-14092 | Medium | 4.7 | 2025-12-05 | A security vulnerability has been detected in Edimax BR-6478AC V3 1.0.15. This issue affects the function sub_416898 of the file /boafrm/formDebugDiagnosticRun… |
CVE-2025-1910 | | 2025-12-04 | The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORIT… | |
CVE-2025-66404 | Medium | 6.4 | 2025-12-03 | MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_… |
CVE-2025-66032 | Critical | 9.8 | 2025-12-03 | Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass… |
CVE-2025-57201 | High | 8.8 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server fu… |
CVE-2025-57199 | High | 8.8 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetect… |
CVE-2025-57198 | High | 8.8 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the Machine.cgi e… |
CVE-2025-57200 | Medium | 6.5 | 2025-12-03 | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the test_mail fun… |
CVE-2025-65657 | Medium | 6.5 | 2025-12-02 | FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers… |
CVE-2025-66399 | High | 8.8 | 2025-12-02 | Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functio… |
CVE-2025-60854 | Critical | 9.8 | 2025-12-02 | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web a… |
CVE-2025-13800 | Medium | 6.3 | 2025-12-01 | A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation… |
CVE-2025-13799 | Medium | 6.3 | 2025-12-01 | A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The ma… |
CVE-2025-13798 | Medium | 6.3 | 2025-12-01 | A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the… |
CVE-2025-13797 | Medium | 6.3 | 2025-12-01 | A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Perform… |
CVE-2025-66219 | Critical | 9.8 | 2025-11-29 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitme… |
CVE-2025-63674 | Medium | 6.8 | 2025-11-24 | An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary code via overriding the bootloader on th… |
CVE-2025-11921 | | 2025-11-24 | iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iSt… | |
CVE-2025-13562 | High | 7.3 | 2025-11-23 | A vulnerability was identified in D-Link DIR-852 1.00. This issue affects some unknown processing of the file /gena.cgi. Such manipulation of the argument serv… |
CVE-2025-65946 | High | 8.1 | 2025-11-21 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo… |