CWE-77 · Command Injection (page 16)
Page 16 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25796 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php. |
CVE-2025-25794 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php. |
CVE-2025-25793 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php. |
CVE-2025-25792 | Medium | 4.4 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php. |
CVE-2025-25791 | Medium | 4.4 | 2025-02-26 | An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Z… |
CVE-2025-27146 | Low | 2.7 | 2025-02-25 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbit… |
CVE-2025-1676 | Medium | 6.3 | 2025-02-25 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the… |
CVE-2024-57685 | Medium | 5.3 | 2025-02-24 | An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file. |
CVE-2024-57608 | Medium | 6.5 | 2025-02-24 | An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component. |
CVE-2025-1616 | Medium | 4.7 | 2025-02-24 | A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality… |
CVE-2025-1610 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_… |
CVE-2025-1609 | Medium | 6.3 | 2025-02-24 | A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file… |
CVE-2025-1608 | Medium | 6.3 | 2025-02-24 | A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd… |
CVE-2025-25768 | Medium | 5.4 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerabili… |
CVE-2025-25605 | Medium | 6.5 | 2025-02-21 | Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua. |
CVE-2025-25604 | Medium | 6.5 | 2025-02-21 | Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua. |
CVE-2025-25766 | Medium | 4.8 | 2025-02-21 | An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .j… |
CVE-2025-1546 | High | 7.3 | 2025-02-21 | A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is th… |
CVE-2025-1536 | High | 7.3 | 2025-02-21 | A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2025-25675 | Critical | 9.8 | 2025-02-20 | Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter fr… |
CVE-2025-1448 | High | 7.3 | 2025-02-19 | A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2025-1370 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf… |
CVE-2025-1369 | Medium | 4.5 | 2025-02-17 | A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-1339 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cg… |
CVE-2025-1338 | High | 7.3 | 2025-02-16 | A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /hand… |
CVE-2025-0593 | High | 8.8 | 2025-02-14 | The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device. |
CVE-2025-22630 | Critical | 9.9 | 2025-02-14 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Com… |
CVE-2025-22962 | High | 7.2 | 2025-02-13 | A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mod… |
CVE-2025-24861 | High | 7.5 | 2025-02-13 | An attacker may inject commands via specially-crafted post requests. |
CVE-2025-1229 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unkn… |
CVE-2025-25743 | High | 7.2 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module. |
CVE-2024-12251 | High | 7.8 | 2025-02-12 | In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink element… |
CVE-2024-33469 | High | 7.9 | 2025-02-11 | An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate method of DatabaseView… |
CVE-2025-23094 | High | 7.3 | 2025-02-06 | The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and… |
CVE-2023-5878 | | 2025-02-06 | Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command inje… | |
CVE-2025-23239 | High | 8.7 | 2025-02-05 | When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iCon… |
CVE-2025-20184 | Medium | 6.5 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an au… |
CVE-2024-55062 | Critical | 9.8 | 2025-01-31 | Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/licen… |
CVE-2024-23971 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-53615 | Medium | 6.5 | 2025-01-30 | A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to exec… |
CVE-2025-0798 | High | 8.1 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-24150 | High | 8.8 | 2025-01-27 | A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL… |
CVE-2024-48841 | Critical | 10.0 | 2025-01-27 | Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older. |
CVE-2024-48419 | High | 8.8 | 2025-01-27 | Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered throug… |
CVE-2024-57590 | Critical | 9.8 | 2025-01-27 | TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute a… |
CVE-2024-52325 | Critical | 9.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection. |
CVE-2025-23196 | High | 8.8 | 2025-01-21 | A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. Th… |
CVE-2024-57539 | High | 8.2 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail. |
CVE-2024-57536 | High | 8.0 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard_status. |
CVE-2024-54794 | Critical | 9.1 | 2025-01-21 | The script input feature of SpagoBI 3.5.1 allows arbitrary code execution. |
CVE-2024-57036 | High | 8.1 | 2025-01-21 | TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an a… |
CVE-2024-41783 | Critical | 9.1 | 2025-01-19 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operati… |
CVE-2024-54681 | Low | 3.5 | 2025-01-17 | Multiple bash files were present in the application's private directory. Bash files can be used on their own, by an attacker that has already full access to… |
CVE-2025-0528 | High | 7.2 | 2025-01-17 | A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality… |
CVE-2024-54660 | High | 8.7 | 2025-01-16 | A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attackers can inject malic… |
CVE-2024-57583 | Critical | 9.8 | 2025-01-16 | Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf function. |
CVE-2025-22912 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept. |
CVE-2025-23052 | High | 7.2 | 2025-01-14 | Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability coul… |
CVE-2024-39783 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP re… |
CVE-2024-39782 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP re… |
CVE-2024-39781 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP re… |
CVE-2024-39765 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-39764 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-39763 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-39762 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-39761 | Critical | 10.0 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39760 | Critical | 10.0 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39759 | Critical | 10.0 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39367 | Critical | 9.1 | 2025-01-14 | An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafte… |
CVE-2024-39360 | Critical | 9.1 | 2025-01-14 | An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request c… |
CVE-2024-37186 | Critical | 9.1 | 2025-01-14 | An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request… |
CVE-2024-34166 | Critical | 10.0 | 2025-01-14 | An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2025-0396 | High | 7.8 | 2025-01-12 | A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of… |
CVE-2024-57228 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57227 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function. |
CVE-2024-57226 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57225 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-57224 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function. |
CVE-2024-57223 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function. |
CVE-2024-57222 | Medium | 6.3 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function. |
CVE-2024-57214 | Medium | 6.3 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-57213 | Medium | 6.3 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function. |
CVE-2024-57212 | Medium | 5.1 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function. |
CVE-2024-57211 | High | 8.0 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function. |
CVE-2025-22949 | Critical | 9.8 | 2025-01-10 | Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution. |
CVE-2025-0328 | High | 7.3 | 2025-01-09 | A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality… |
CVE-2024-27980 | High | 8.1 | 2025-01-09 | Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands a… |
CVE-2024-53526 | Medium | 6.4 | 2025-01-08 | composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function. |
CVE-2024-51442 | High | 8.8 | 2025-01-08 | Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration… |
CVE-2024-55414 | Critical | 9.8 | 2025-01-07 | A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via spe… |
CVE-2024-54007 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-54006 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-13129 | High | 8.8 | 2025-01-03 | A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file a… |
CVE-2024-13062 | High | 7.2 | 2025-01-02 | An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. Refer to the ' 01/02/202… |
CVE-2024-12912 | High | 7.2 | 2025-01-02 | An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiC… |
CVE-2024-12987 | High | 7.3 | 2024-12-27 | A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/m… |
CVE-2024-12986 | High | 7.3 | 2024-12-27 | A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processin… |
CVE-2024-12985 | Medium | 6.3 | 2024-12-27 | A vulnerability classified as critical was found in Overtek OT-E801G OTE801G65.1.1.0. This vulnerability affects unknown code of the file /diag_ping.cmd?action… |
CVE-2020-13712 | High | 7.8 | 2024-12-20 | A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is a… |
CVE-2022-32203 | Critical | 9.8 | 2024-12-20 | There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in the highest privileges of the printer. (… |