CWE-77 · Command Injection (page 13)
Page 13 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49836 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py chang… |
CVE-2025-49835 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_… |
CVE-2025-49834 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_… |
CVE-2025-49833 | Critical | 9.8 | 2025-07-15 | GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py o… |
CVE-2025-52377 | Medium | 5.4 | 2025-07-15 | Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary comm… |
CVE-2025-3621 | Critical | 9.6 | 2025-07-15 | Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: *… |
CVE-2025-51650 | Medium | 5.6 | 2025-07-14 | An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a… |
CVE-2025-7615 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/c… |
CVE-2025-7614 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2025-7613 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/… |
CVE-2025-50756 | Critical | 9.8 | 2025-07-14 | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allow… |
CVE-2025-7578 | Medium | 5.0 | 2025-07-14 | A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been declared as critical. This vulnerability affects the functio… |
CVE-2025-7553 | Medium | 4.7 | 2025-07-14 | A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The m… |
CVE-2025-7525 | Medium | 6.3 | 2025-07-13 | A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of t… |
CVE-2025-7524 | Medium | 6.3 | 2025-07-13 | A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-… |
CVE-2025-7415 | Medium | 6.3 | 2025-07-10 | A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /g… |
CVE-2025-7414 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPi… |
CVE-2025-7407 | Medium | 6.3 | 2025-07-10 | A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of… |
CVE-2025-7192 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin o… |
CVE-2025-53355 | High | 7.5 | 2025-07-08 | MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kuber… |
CVE-2025-37102 | High | 7.2 | 2025-07-08 | An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation… |
CVE-2025-53372 | High | 7.5 | 2025-07-08 | node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3… |
CVE-2025-7154 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the… |
CVE-2025-7097 | High | 8.1 | 2025-07-06 | A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing o… |
CVE-2025-7083 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp of the component w… |
CVE-2025-7082 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/… |
CVE-2025-7081 | Medium | 6.3 | 2025-07-06 | A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the fil… |
CVE-2025-24333 | Medium | 6.4 | 2025-07-02 | Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in the… |
CVE-2025-53104 | Critical | 9.1 | 2025-07-01 | gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerab… |
CVE-2025-53107 | High | 7.5 | 2025-07-01 | @cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability cause… |
CVE-2025-52995 | High | 8.0 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-45931 | Critical | 9.8 | 2025-06-30 | An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file |
CVE-2025-6899 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file m… |
CVE-2025-6898 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6897 | Medium | 5.5 | 2025-06-30 | A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_d… |
CVE-2025-6896 | Medium | 6.3 | 2025-06-30 | A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulati… |
CVE-2025-53098 | High | 8.1 | 2025-06-27 | Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within t… |
CVE-2025-6775 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v… |
CVE-2025-6522 | Medium | 5.4 | 2025-06-27 | Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available o… |
CVE-2025-5306 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778 |
CVE-2025-52904 | High | 8.0 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-52903 | High | 8.0 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-6621 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulatio… |
CVE-2025-6620 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upg… |
CVE-2025-6619 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the… |
CVE-2025-6618 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so… |
CVE-2025-52483 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-6485 | Medium | 6.3 | 2025-06-22 | A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /… |
CVE-2025-6335 | Medium | 4.7 | 2025-06-20 | A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php… |
CVE-2025-6299 | Medium | 4.7 | 2025-06-20 | A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulati… |
CVE-2025-23170 | Medium | 6.7 | 2025-06-19 | The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The… |
CVE-2025-49823 | Unrated | | 2025-06-17 | (conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts proce… |
CVE-2025-6104 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/p… |
CVE-2025-6103 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functio… |
CVE-2025-6102 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-45988 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45987 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45986 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45985 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45984 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_A… |
CVE-2025-22237 | Medium | 6.7 | 2025-06-13 | An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary comma… |
CVE-2025-47959 | High | 7.1 | 2025-06-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a netwo… |
CVE-2025-4231 | High | 7.2 | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker… |
CVE-2025-4678 | | 2025-06-10 | Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105. | |
CVE-2025-4653 | | 2025-06-10 | Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105. | |
CVE-2025-5952 | High | 7.3 | 2025-06-10 | A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php… |
CVE-2025-5836 | Medium | 6.3 | 2025-06-07 | A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg o… |
CVE-2025-22481 | High | 8.8 | 2025-06-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2025-5763 | Medium | 4.7 | 2025-06-06 | A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the fil… |
CVE-2025-5695 | Medium | 4.7 | 2025-06-05 | A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the fil… |
CVE-2025-5621 | High | 7.3 | 2025-06-05 | A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file… |
CVE-2025-5620 | High | 7.3 | 2025-06-05 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 1.10CNB05. Affected is the function setipsec_config of the file /goform/setipsec… |
CVE-2025-5606 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/… |
CVE-2025-20278 | Medium | 6.0 | 2025-06-04 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the… |
CVE-2025-5573 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been rated as critical. Affected by this issue is the function setSystemWizard/setSystemControl of… |
CVE-2025-5571 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the file /setSystemAdmin… |
CVE-2025-5525 | Medium | 5.6 | 2025-06-03 | A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/ut… |
CVE-2025-5515 | Medium | 6.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20230726.1108. Affected by this issue is some unknown functionality… |
CVE-2025-5504 | Medium | 6.3 | 2025-06-03 | A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/… |
CVE-2025-5502 | Medium | 6.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the function formMapReboot of… |
CVE-2025-5492 | Medium | 6.3 | 2025-06-03 | A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub_456DE8 of th… |
CVE-2025-31710 | Medium | 5.9 | 2025-06-03 | In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no addit… |
CVE-2025-27954 | Medium | 6.5 | 2025-06-02 | An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken func… |
CVE-2025-27953 | Medium | 6.5 | 2025-06-02 | An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session manage… |
CVE-2025-37096 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-5447 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been dec… |
CVE-2025-37092 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37091 | High | 7.2 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37089 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-5446 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been cla… |
CVE-2025-5445 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified a… |
CVE-2025-5444 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classif… |
CVE-2025-5443 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1… |
CVE-2025-5442 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.00… |
CVE-2025-5441 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2… |
CVE-2025-5440 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003… |
CVE-2025-5439 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rat… |
CVE-2025-5438 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been dec… |
CVE-2025-5113 | | 2025-06-02 | The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used. | |
CVE-2025-4010 | | 2025-06-02 | The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable… |