CWE-77 · Command Injection (page 12)
Page 12 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13442 | High | 7.3 | 2025-11-20 | A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdb… |
CVE-2025-37162 | Medium | 6.5 | 2025-11-18 | A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successfu… |
CVE-2025-63749 | Medium | 6.5 | 2025-11-18 | pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter. |
CVE-2025-37163 | High | 7.2 | 2025-11-18 | A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker cou… |
CVE-2025-63258 | Medium | 6.5 | 2025-11-18 | A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers and XiaoBei series routers, cloud gateways, and wireless acce… |
CVE-2025-63604 | Medium | 6.5 | 2025-11-18 | A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validatio… |
CVE-2025-63603 | Medium | 6.5 | 2025-11-18 | A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/… |
CVE-2025-13306 | Medium | 6.3 | 2025-11-18 | A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formD… |
CVE-2025-6945 | Low | 3.5 | 2025-11-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed… |
CVE-2025-60702 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` f… |
CVE-2025-63406 | High | 8.8 | 2025-11-13 | An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in… |
CVE-2025-60676 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSett… |
CVE-2025-60675 | Medium | 5.4 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which p… |
CVE-2025-60673 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDMZSettings… |
CVE-2025-60672 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSS… |
CVE-2025-60701 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_433188` func… |
CVE-2025-60700 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. The `sub_4455B… |
CVE-2025-60698 | High | 7.3 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` func… |
CVE-2025-60697 | High | 7.3 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` func… |
CVE-2025-60671 | Medium | 5.4 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which p… |
CVE-2025-60689 | Medium | 5.4 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001… |
CVE-2025-60687 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41… |
CVE-2025-60683 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4… |
CVE-2025-60682 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the… |
CVE-2025-46428 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vul… |
CVE-2025-46427 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vuln… |
CVE-2025-62222 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacke… |
CVE-2025-62214 | Medium | 6.7 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. |
CVE-2024-57695 | High | 7.7 | 2025-11-11 | An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock functio… |
CVE-2025-9223 | High | 8.8 | 2025-11-11 | Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper config… |
CVE-2025-63296 | Medium | 6.5 | 2025-11-10 | KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin… |
CVE-2025-12155 | | 2025-11-10 | A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission… | |
CVE-2025-12916 | Medium | 6.3 | 2025-11-09 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_lo… |
CVE-2025-46365 | Medium | 5.3 | 2025-11-05 | Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection… |
CVE-2024-51317 | Medium | 6.5 | 2025-11-03 | An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function |
CVE-2025-61141 | High | 7.5 | 2025-10-30 | sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and con… |
CVE-2025-60595 | High | 8.2 | 2025-10-29 | SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. |
CVE-2025-1549 | | 2025-10-29 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elev… | |
CVE-2025-12313 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipu… |
CVE-2025-12296 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handle… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-58428 | Critical | 9.9 | 2025-10-23 | The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attacker… |
CVE-2025-54964 | High | 8.4 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If… |
CVE-2025-41721 | Low | 2.7 | 2025-10-22 | A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a p… |
CVE-2025-56799 | Medium | 6.5 | 2025-10-21 | Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this… |
CVE-2025-57521 | Medium | 6.1 | 2025-10-21 | Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a netwo… |
CVE-2025-10020 | High | 8.5 | 2025-10-21 | Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component. |
CVE-2025-62696 | | 2025-10-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboar… | |
CVE-2025-57164 | Medium | 6.5 | 2025-10-17 | Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field. |
CVE-2025-61514 | Medium | 6.5 | 2025-10-16 | An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG fil… |
CVE-2025-60855 | Medium | 5.1 | 2025-10-16 | Reolink Video Doorbell WiFi DB_566128M5MP_W performs insufficient validation of firmware update signatures. This allows attackers to load malicious firmware im… |
CVE-2025-58132 | Medium | 4.1 | 2025-10-15 | Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
CVE-2025-34267 | Critical | 9.9 | 2025-10-14 | Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox… |
CVE-2025-37146 | High | 7.2 | 2025-10-14 | A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform re… |
CVE-2025-37138 | Medium | 6.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating sy… |
CVE-2025-37134 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37133 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-11665 | Medium | 4.7 | 2025-10-13 | A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler… |
CVE-2025-60838 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-60268 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadCon… |
CVE-2025-59286 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59272 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosur… |
CVE-2025-59252 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-56426 | Medium | 6.5 | 2025-10-09 | An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logi… |
CVE-2025-11523 | Medium | 6.3 | 2025-10-09 | A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argumen… |
CVE-2025-11491 | Medium | 6.3 | 2025-10-08 | A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager… |
CVE-2025-11490 | Medium | 6.3 | 2025-10-08 | A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/comman… |
CVE-2025-11488 | High | 7.3 | 2025-10-08 | A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command i… |
CVE-2025-61787 | High | 8.1 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when… |
CVE-2025-11407 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the arg… |
CVE-2025-11335 | Medium | 4.7 | 2025-10-06 | A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=q… |
CVE-2025-11331 | Medium | 4.7 | 2025-10-06 | A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Webs… |
CVE-2025-11303 | Medium | 6.3 | 2025-10-05 | A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing a manipulation of the argument comma… |
CVE-2025-11298 | Medium | 6.3 | 2025-10-05 | A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the… |
CVE-2025-11292 | Medium | 6.3 | 2025-10-05 | A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing a manipulation of… |
CVE-2025-11285 | Medium | 6.3 | 2025-10-05 | A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController… |
CVE-2025-59741 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59740 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59739 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59738 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59737 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59736 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59735 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59337 | Medium | 6.8 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed… |
CVE-2025-61045 | Critical | 9.8 | 2025-10-01 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function. |
CVE-2025-61044 | Critical | 9.8 | 2025-10-01 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg functio… |
CVE-2025-61584 | | 2025-09-30 | serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulne… | |
CVE-2025-41250 | High | 8.5 | 2025-09-29 | VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create sc… |
CVE-2025-11141 | Medium | 4.7 | 2025-09-29 | A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.p… |
CVE-2025-11138 | Medium | 6.3 | 2025-09-29 | A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results i… |
CVE-2025-11121 | Medium | 6.3 | 2025-09-28 | A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipula… |
CVE-2025-11100 | Medium | 6.3 | 2025-09-28 | A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to… |
CVE-2025-11099 | Medium | 6.3 | 2025-09-28 | A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulatio… |
CVE-2025-11098 | Medium | 6.3 | 2025-09-28 | A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of t… |
CVE-2025-11097 | Medium | 6.3 | 2025-09-28 | A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument… |
CVE-2025-11096 | Medium | 6.3 | 2025-09-28 | A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the… |
CVE-2025-11095 | Medium | 6.3 | 2025-09-28 | A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulat… |
CVE-2025-11092 | Medium | 6.3 | 2025-09-28 | A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manip… |
CVE-2025-11073 | Medium | 4.7 | 2025-09-27 | A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luc… |
CVE-2025-11045 | High | 7.3 | 2025-09-26 | A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. This affects an unknown function of the file /usb_paswd.asp. The manipul… |