CWE-77 · Command Injection (page 14)
Page 14 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48936 | High | 8.1 | 2025-05-30 | Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset… |
CVE-2025-48492 | High | 8.8 | 2025-05-30 | GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject ar… |
CVE-2024-57338 | Medium | 6.5 | 2025-05-28 | An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to exec… |
CVE-2024-57337 | Medium | 6.5 | 2025-05-28 | An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8… |
CVE-2025-4009 | | 2025-05-28 | The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. Thi… | |
CVE-2025-5265 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially lead… |
CVE-2025-5264 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leadin… |
CVE-2025-5147 | Medium | 6.3 | 2025-05-25 | A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical. This issue affects the function tools_ping of t… |
CVE-2025-5146 | Medium | 6.3 | 2025-05-25 | A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vul… |
CVE-2025-5145 | Medium | 6.3 | 2025-05-25 | A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 202505… |
CVE-2025-5139 | Medium | 5.6 | 2025-05-25 | A vulnerability was found in Qualitor 8.20/8.24. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adcon… |
CVE-2025-5126 | High | 8.8 | 2025-05-24 | A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\setti… |
CVE-2025-46176 | Medium | 6.5 | 2025-05-23 | Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary commands via firmwa… |
CVE-2025-5106 | High | 7.3 | 2025-05-23 | A vulnerability was found in Fujian Kelixun 1.0. It has been classified as critical. This affects an unknown part of the file /app/fax/fax_view.php of the comp… |
CVE-2025-32813 | High | 7.2 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur. |
CVE-2025-5030 | Medium | 5.0 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file… |
CVE-2025-20258 | Medium | 5.4 | 2025-05-21 | A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent… |
CVE-2025-4008 | High | 8.8 | 2025-05-21 | The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web… |
CVE-2025-5000 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel… |
CVE-2025-4999 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153F… |
CVE-2025-44084 | Critical | 9.8 | 2025-05-20 | D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the com… |
CVE-2025-43714 | Medium | 6.5 | 2025-05-19 | The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which e… |
CVE-2024-55063 | High | 8.8 | 2025-05-19 | Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code via the (1) lang param… |
CVE-2025-4851 | Medium | 6.3 | 2025-05-18 | A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file… |
CVE-2025-4850 | Medium | 6.3 | 2025-05-18 | A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/… |
CVE-2025-4849 | Medium | 6.3 | 2025-05-18 | A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUser… |
CVE-2025-4747 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ip_s… |
CVE-2025-4729 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-32702 | High | 7.8 | 2025-05-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally. |
CVE-2024-55466 | Medium | 6.5 | 2025-05-12 | An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to… |
CVE-2025-44176 | Medium | 6.5 | 2025-05-12 | Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function. |
CVE-2025-29509 | High | 8.8 | 2025-05-09 | Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external websit… |
CVE-2024-12442 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access. |
CVE-2024-11861 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access. |
CVE-2025-4454 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04. It has been declared as critical. This vulnerability affects the function wake_on_lan. The manipulation o… |
CVE-2025-4453 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argumen… |
CVE-2025-4445 | Medium | 6.3 | 2025-05-09 | A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac le… |
CVE-2025-4443 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argume… |
CVE-2025-45798 | Critical | 9.8 | 2025-05-08 | A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the… |
CVE-2025-44023 | Medium | 6.5 | 2025-05-08 | An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_admin_pw components. |
CVE-2023-51295 | Medium | 6.5 | 2025-05-08 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_ap… |
CVE-2025-31644 | High | 8.7 | 2025-05-07 | When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow a… |
CVE-2025-29154 | Medium | 6.5 | 2025-05-07 | HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted/solicitacao_treina… |
CVE-2025-46816 | Critical | 9.4 | 2025-05-06 | goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone t… |
CVE-2025-46735 | | 2025-05-06 | Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Prov… | |
CVE-2025-26262 | Medium | 6.5 | 2025-05-06 | An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and execute arbitrary code… |
CVE-2025-22476 | Medium | 5.5 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection… |
CVE-2025-45492 | Critical | 9.8 | 2025-05-06 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function. |
CVE-2025-45491 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter. |
CVE-2025-45490 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter. |
CVE-2025-45489 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter. |
CVE-2025-45488 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter. |
CVE-2025-45487 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function. |
CVE-2025-4357 | Medium | 4.7 | 2025-05-06 | A vulnerability was found in Tenda RX3 16.03.13.11_multi. It has been rated as critical. This issue affects some unknown processing of the file /goform/telnet… |
CVE-2025-4350 | High | 8.8 | 2025-05-06 | A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01. This vulnerability affects the function wake_on_lan. The manipulation of the… |
CVE-2025-4349 | High | 8.8 | 2025-05-06 | A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument… |
CVE-2025-4341 | Medium | 6.3 | 2025-05-06 | A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdoc… |
CVE-2025-4340 | Medium | 6.3 | 2025-05-06 | A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /h… |
CVE-2025-43844 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-43843 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-43842 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2024-57235 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57234 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps functi… |
CVE-2024-57233 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57232 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode f… |
CVE-2024-57231 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fu… |
CVE-2024-57230 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fu… |
CVE-2024-57229 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2025-45042 | Critical | 9.8 | 2025-05-05 | Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. |
CVE-2025-25504 | Medium | 6.5 | 2025-05-05 | An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connec… |
CVE-2025-45800 | Critical | 9.8 | 2025-05-02 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, s… |
CVE-2025-44877 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerabil… |
CVE-2025-44872 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnera… |
CVE-2025-44868 | Critical | 9.8 | 2025-05-02 | Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vuln… |
CVE-2025-46625 | High | 8.8 | 2025-05-01 | Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to… |
CVE-2025-44867 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerabilit… |
CVE-2025-44866 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows… |
CVE-2025-44865 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allow… |
CVE-2025-44864 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allow… |
CVE-2025-44863 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerabi… |
CVE-2025-44862 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vu… |
CVE-2025-44861 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url paramete… |
CVE-2025-44860 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerab… |
CVE-2025-44848 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerab… |
CVE-2025-44847 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This… |
CVE-2025-44846 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This v… |
CVE-2025-44845 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This… |
CVE-2025-44844 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vu… |
CVE-2025-44843 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url paramet… |
CVE-2025-44842 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnera… |
CVE-2025-44841 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version par… |
CVE-2025-44840 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn paramet… |
CVE-2025-44839 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid par… |
CVE-2025-44838 | Medium | 6.3 | 2025-05-01 | TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName paramete… |
CVE-2025-44837 | Medium | 6.3 | 2025-05-01 | TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or… |
CVE-2025-44836 | Medium | 6.3 | 2025-05-01 | TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute p… |
CVE-2025-44854 | Medium | 6.3 | 2025-05-01 | TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vul… |
CVE-2025-44835 | Medium | 6.3 | 2025-05-01 | D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbitrary commands via s… |
CVE-2025-4135 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulatio… |
CVE-2025-4122 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of… |