CWE-77 · Command Injection (page 12)
Page 12 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48979 | Low | 3.4 | 2025-08-29 | An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access. |
CVE-2025-9586 | Medium | 6.3 | 2025-08-28 | A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipu… |
CVE-2025-9585 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of th… |
CVE-2025-9584 | Medium | 6.3 | 2025-08-28 | A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of… |
CVE-2025-9583 | Medium | 6.3 | 2025-08-28 | A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulatio… |
CVE-2025-9582 | Medium | 6.3 | 2025-08-28 | A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timest… |
CVE-2025-9581 | Medium | 6.3 | 2025-08-28 | A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argumen… |
CVE-2025-9580 | Medium | 6.3 | 2025-08-28 | A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Ha… |
CVE-2025-9579 | Medium | 6.3 | 2025-08-28 | A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP… |
CVE-2025-9575 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue… |
CVE-2025-50428 | Critical | 9.8 | 2025-08-27 | In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sa… |
CVE-2025-50989 | Critical | 9.1 | 2025-08-27 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span P… |
CVE-2025-9528 | Medium | 4.7 | 2025-08-27 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing… |
CVE-2025-9424 | Medium | 4.7 | 2025-08-25 | A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Affected by this vulnerability is an unknown functionality of the file /itbox_pi/branch_import.ph… |
CVE-2025-50722 | Critical | 9.8 | 2025-08-25 | Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component |
CVE-2025-29523 | High | 7.2 | 2025-08-25 | D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 function. |
CVE-2025-44179 | Medium | 6.5 | 2025-08-25 | Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service. The issue arises due to improper input validation within th… |
CVE-2025-29522 | Medium | 6.5 | 2025-08-25 | D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping function. |
CVE-2025-29519 | Medium | 5.3 | 2025-08-25 | A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to execute arbitrary comma… |
CVE-2025-29517 | Medium | 6.8 | 2025-08-25 | D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 function. |
CVE-2025-29516 | High | 7.2 | 2025-08-25 | D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the backup function. |
CVE-2025-9387 | Medium | 6.3 | 2025-08-24 | A vulnerability was found in DCN DCME-720 9.1.5.11. This affects an unknown function of the file /usr/local/www/function/audit/newstatistics/ip_block.php of th… |
CVE-2025-57105 | Critical | 9.8 | 2025-08-22 | The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in m… |
CVE-2025-55637 | Critical | 9.8 | 2025-08-22 | Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the… |
CVE-2025-41451 | | 2025-08-22 | Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4… | |
CVE-2025-48978 | High | 7.5 | 2025-08-21 | An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch… |
CVE-2025-24285 | Critical | 9.8 | 2025-08-21 | Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to t… |
CVE-2025-9262 | Medium | 5.6 | 2025-08-20 | A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handl… |
CVE-2025-9244 | Medium | 6.3 | 2025-08-20 | A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001… |
CVE-2025-57733 | Medium | 5.5 | 2025-08-20 | In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content |
CVE-2025-9176 | Medium | 5.3 | 2025-08-20 | A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Hand… |
CVE-2025-9174 | Medium | 5.3 | 2025-08-19 | A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src/shc.c of the component Filename Handle… |
CVE-2025-52337 | Medium | 6.5 | 2025-08-19 | An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5.0.9.7000 allows attackers to execute a… |
CVE-2025-50891 | High | 7.2 | 2025-08-19 | The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking. NOTE: a cust… |
CVE-2025-9149 | Medium | 6.3 | 2025-08-19 | A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation o… |
CVE-2025-55294 | Critical | 9.8 | 2025-08-19 | screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed i… |
CVE-2025-50461 | Medium | 6.5 | 2025-08-19 | A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/model_merger.py script when using the "fsdp" backend. The script… |
CVE-2025-55591 | Critical | 9.8 | 2025-08-18 | TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint. |
CVE-2025-55590 | Medium | 6.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html. |
CVE-2025-55283 | Critical | 9.1 | 2025-08-18 | aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside P… |
CVE-2025-9090 | Medium | 6.3 | 2025-08-17 | A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. T… |
CVE-2025-9026 | High | 7.3 | 2025-08-15 | A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Di… |
CVE-2025-50817 | Medium | 5.4 | 2025-08-14 | A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loa… |
CVE-2025-50515 | Medium | 6.5 | 2025-08-14 | An issue was discovered in phome Empirebak 2010 in ebak2008/upload/class/config.php allowing attackers to execute arbitrary code when the config file was loade… |
CVE-2025-20306 | Medium | 4.9 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker w… |
CVE-2024-53945 | High | 8.8 | 2025-08-14 | The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticat… |
CVE-2025-8956 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The man… |
CVE-2025-8937 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation lead… |
CVE-2025-45317 | Medium | 6.5 | 2025-08-13 | A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive. |
CVE-2025-53773 | High | 7.8 | 2025-08-12 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2025-8830 | Medium | 6.3 | 2025-08-11 | A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of… |
CVE-2025-8829 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_r… |
CVE-2025-8828 | Medium | 6.3 | 2025-08-11 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /gofor… |
CVE-2025-8827 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function um_inspect_cross_band of… |
CVE-2025-8825 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function RP_setBasicAuto of the fi… |
CVE-2025-8823 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setDevice… |
CVE-2025-8821 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function RP_setBasic of the… |
CVE-2025-8818 | Medium | 6.3 | 2025-08-10 | A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSettin… |
CVE-2025-8752 | High | 7.3 | 2025-08-09 | A vulnerability was found in wangzhixuan spring-shiro-training up to 94812c1fd8f7fe796c931f4984ff1aa0671ab562. It has been declared as critical. This vulnerabi… |
CVE-2025-53787 | High | 8.2 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53774 | Medium | 6.5 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-8697 | Medium | 6.3 | 2025-08-07 | A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPS… |
CVE-2025-54393 | Medium | 5.4 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obtain administrative… |
CVE-2025-47188 | Medium | 6.5 | 2025-08-07 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4… |
CVE-2025-7769 | | 2025-08-06 | Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remot… | |
CVE-2025-8667 | Medium | 6.3 | 2025-08-06 | A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the fun… |
CVE-2025-8665 | Medium | 6.3 | 2025-08-06 | A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the l… |
CVE-2025-45512 | Medium | 6.5 | 2025-08-05 | A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files… |
CVE-2025-50688 | Medium | 6.5 | 2025-08-05 | A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can ex… |
CVE-2025-27212 | Critical | 9.8 | 2025-08-04 | An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management networ… |
CVE-2025-27211 | High | 7.5 | 2025-08-04 | An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch… |
CVE-2025-54782 | High | 8.8 | 2025-08-02 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability w… |
CVE-2025-54424 | High | 8.1 | 2025-08-01 | 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTP… |
CVE-2025-54131 | Medium | 6.4 | 2025-08-01 | Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(c… |
CVE-2025-54564 | High | 7.8 | 2025-08-01 | uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user. |
CVE-2025-26063 | Critical | 9.8 | 2025-07-31 | An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSI… |
CVE-2025-45619 | Medium | 6.5 | 2025-07-30 | An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function |
CVE-2025-25692 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-25691 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-52284 | Medium | 6.5 | 2025-07-29 | Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerabil… |
CVE-2025-8259 | High | 7.3 | 2025-07-28 | A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_se… |
CVE-2025-8244 | High | 8.8 | 2025-07-27 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formMap… |
CVE-2025-54416 | Critical | 9.1 | 2025-07-26 | tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 a… |
CVE-2025-29628 | Critical | 9.4 | 2025-07-25 | A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Applicat… |
CVE-2025-54377 | High | 7.8 | 2025-07-23 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in it… |
CVE-2025-51472 | Medium | 6.5 | 2025-07-22 | Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious… |
CVE-2025-51459 | Medium | 6.5 | 2025-07-22 | File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a maliciou… |
CVE-2025-7952 | Medium | 6.3 | 2025-07-22 | A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of… |
CVE-2025-53832 | High | 7.5 | 2025-07-21 | Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability… |
CVE-2025-7932 | Medium | 6.3 | 2025-07-21 | A vulnerability classified as critical has been found in D-Link DIR‑817L up to 1.04B01. This affects the function lxmldbc_system of the file ssdpcgi. The manip… |
CVE-2025-46122 | Critical | 9.1 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cm… |
CVE-2025-7883 | High | 7.8 | 2025-07-20 | A vulnerability classified as critical has been found in Eluktronics Control Center 5.23.51.41. Affected is an unknown function of the file \AiStoneService\MyC… |
CVE-2025-7836 | Medium | 6.3 | 2025-07-19 | A vulnerability has been found in D-Link DIR-816L up to 2.06B01 and classified as critical. Affected by this vulnerability is the function lxmldbc_system of th… |
CVE-2025-54073 | High | 7.5 | 2025-07-18 | mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with efficient access to package documentation across multiple programming langua… |
CVE-2025-7788 | Medium | 6.3 | 2025-07-18 | A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of t… |
CVE-2025-52046 | Critical | 9.8 | 2025-07-17 | Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This… |
CVE-2023-47356 | High | 8.8 | 2025-07-17 | Mingyu Security Gateway before v3.0-5.3p was discovered to contain a remote command execution (RCE) vulnerability via the log_type parameter at /log/fw_securit… |
CVE-2025-52690 | High | 8.1 | 2025-07-16 | Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality… |
CVE-2025-52688 | Critical | 9.8 | 2025-07-16 | Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the lo… |
CVE-2025-52687 | Low | 2.4 | 2025-07-16 | Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into th… |