CWE-77 · Command Injection (page 15)
Page 15 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4121 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The ma… |
CVE-2025-45011 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows r… |
CVE-2025-45010 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerab… |
CVE-2025-45009 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remo… |
CVE-2025-4076 | Medium | 6.3 | 2025-04-29 | A vulnerability classified as critical has been found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function easy_uci_set_option_string_0 of the file /cg… |
CVE-2025-4089 | Medium | 5.1 | 2025-04-29 | Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading t… |
CVE-2025-4032 | Medium | 5.0 | 2025-04-28 | A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function… |
CVE-2025-3987 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/for… |
CVE-2025-3983 | Medium | 4.7 | 2025-04-27 | A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-43858 | Critical | 9.2 | 2025-04-24 | YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe c… |
CVE-2025-28017 | Medium | 6.5 | 2025-04-23 | TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter. |
CVE-2025-29743 | Medium | 6.5 | 2025-04-22 | D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting. |
CVE-2025-43948 | High | 7.3 | 2025-04-22 | Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier (such as for sorting), which… |
CVE-2024-40445 | High | 7.3 | 2025-04-22 | A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulati… |
CVE-2025-3816 | Medium | 4.7 | 2025-04-19 | A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the co… |
CVE-2025-29209 | Critical | 9.8 | 2025-04-18 | TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi. |
CVE-2024-46089 | Medium | 6.3 | 2025-04-18 | 74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin. |
CVE-2025-43012 | High | 8.3 | 2025-04-17 | In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible |
CVE-2025-3729 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2024-53305 | High | 7.3 | 2025-04-16 | An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query. |
CVE-2024-40070 | Medium | 5.1 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This… |
CVE-2024-36842 | High | 7.3 | 2025-04-15 | An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Number PlatformVER:K24-2… |
CVE-2025-28145 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDisk… |
CVE-2025-28143 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/… |
CVE-2025-28142 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/for… |
CVE-2025-3546 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affec… |
CVE-2025-3545 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Aff… |
CVE-2025-3544 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue a… |
CVE-2025-3543 | High | 8.0 | 2025-04-14 | A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability aff… |
CVE-2025-3542 | High | 8.0 | 2025-04-14 | A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_Wiza… |
CVE-2025-3541 | High | 8.0 | 2025-04-13 | A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by th… |
CVE-2025-3540 | High | 8.0 | 2025-04-13 | A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability… |
CVE-2025-3539 | High | 8.0 | 2025-04-13 | A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is… |
CVE-2025-27083 | High | 7.2 | 2025-04-08 | Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful explo… |
CVE-2025-3249 | Medium | 6.3 | 2025-04-04 | A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of th… |
CVE-2025-29063 | Critical | 9.8 | 2025-04-02 | An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not h… |
CVE-2025-29062 | Critical | 9.8 | 2025-04-02 | An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead… |
CVE-2025-26056 | Medium | 5.4 | 2025-04-01 | A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper v… |
CVE-2024-54802 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header. |
CVE-2025-3008 | Medium | 5.5 | 2025-03-31 | A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0. Affected is the function system/popen of the file /usr/nova/bin/netconfig… |
CVE-2025-3002 | High | 7.3 | 2025-03-31 | A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the f… |
CVE-2025-22941 | Critical | 9.8 | 2025-03-31 | A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary c… |
CVE-2025-22939 | Critical | 9.8 | 2025-03-31 | A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary… |
CVE-2025-2983 | Medium | 5.5 | 2025-03-31 | A vulnerability has been found in Legrand SMS PowerView 1.x and classified as critical. Affected by this vulnerability is an unknown functionality. The manipul… |
CVE-2025-2916 | Medium | 6.3 | 2025-03-28 | A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This issue affects some unknown processing of t… |
CVE-2024-9773 | Low | 3.7 | 2025-03-27 | An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions start… |
CVE-2024-55030 | Critical | 9.8 | 2025-03-25 | A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. |
CVE-2025-29635 | High | 7.2 | 2025-03-25 | A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending… |
CVE-2025-2733 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execu… |
CVE-2025-2732 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected… |
CVE-2025-2731 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affec… |
CVE-2025-2730 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Aff… |
CVE-2025-2729 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue a… |
CVE-2025-2728 | High | 8.0 | 2025-03-25 | A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2025-2727 | High | 8.0 | 2025-03-25 | A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetw… |
CVE-2025-2726 | High | 8.0 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014… |
CVE-2025-2725 | High | 8.0 | 2025-03-25 | A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this… |
CVE-2025-2717 | Medium | 4.7 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /gof… |
CVE-2025-2701 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in AMTT Hotel Broadband Operation System 1.0. This vulnerability affects the function popen of the file /manag… |
CVE-2025-29230 | High | 8.6 | 2025-03-21 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via th… |
CVE-2025-29227 | Medium | 6.3 | 2025-03-21 | In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize… |
CVE-2025-29226 | Medium | 6.3 | 2025-03-21 | In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"]… |
CVE-2025-29223 | Medium | 6.3 | 2025-03-21 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function. |
CVE-2025-25274 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated us… |
CVE-2024-8156 | Critical | 9.8 | 2025-03-20 | A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is us… |
CVE-2025-22473 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2025-22472 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48017 | Medium | 6.5 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48015 | Medium | 6.7 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48830 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-12992 | Critical | 9.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 7… |
CVE-2024-12971 | High | 8.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 |
CVE-2025-2367 | Medium | 6.3 | 2025-03-17 | A vulnerability has been found in Oiwtech OIW-2431APGN-HP 2.5.3-B20131128 and classified as critical. This vulnerability affects unknown code of the file /boaf… |
CVE-2023-33300 | Medium | 5.3 | 2025-03-14 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker… |
CVE-2024-46662 | High | 8.8 | 2025-03-14 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiManager Cloud… |
CVE-2024-8402 | Low | 3.7 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions start… |
CVE-2024-27763 | Medium | 5.3 | 2025-03-12 | XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in the presence of a cr… |
CVE-2024-13871 | High | 8.8 | 2025-03-12 | A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw al… |
CVE-2025-26627 | High | 7.0 | 2025-03-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2025-24049 | High | 8.4 | 2025-03-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to… |
CVE-2025-1497 | Critical | 9.8 | 2025-03-10 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to exec… |
CVE-2025-2096 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the fi… |
CVE-2025-2095 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cste… |
CVE-2025-2094 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConf… |
CVE-2024-53700 | High | 7.2 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gained administrator… |
CVE-2024-53692 | Medium | 4.7 | 2025-03-07 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2025-26331 | High | 7.8 | 2025-03-07 | Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged att… |
CVE-2025-25632 | Critical | 9.8 | 2025-03-05 | Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. |
CVE-2025-1947 | Medium | 6.3 | 2025-03-04 | A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageC… |
CVE-2025-1946 | Medium | 6.3 | 2025-03-04 | A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the… |
CVE-2025-27423 | High | 7.1 | 2025-03-03 | Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompresse… |
CVE-2025-1845 | Medium | 6.3 | 2025-03-03 | A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admi… |
CVE-2025-1829 | Medium | 6.3 | 2025-03-02 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the… |
CVE-2025-1819 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. T… |
CVE-2025-1800 | Medium | 6.3 | 2025-03-01 | A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view… |
CVE-2025-23119 | High | 7.5 | 2025-03-01 | An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with… |
CVE-2025-20117 | Medium | 5.1 | 2025-02-26 | A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating sy… |
CVE-2025-25813 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php. |
CVE-2025-25802 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php. |
CVE-2025-25797 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php. |