CWE-77 · Command Injection (page 16)
Page 16 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4999 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153F… |
CVE-2025-44084 | Critical | 9.8 | 2025-05-20 | D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the com… |
CVE-2025-43714 | Medium | 6.5 | 2025-05-19 | The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which e… |
CVE-2024-55063 | High | 8.8 | 2025-05-19 | Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code via the (1) lang param… |
CVE-2025-4851 | Medium | 6.3 | 2025-05-18 | A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file… |
CVE-2025-4850 | Medium | 6.3 | 2025-05-18 | A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/… |
CVE-2025-4849 | Medium | 6.3 | 2025-05-18 | A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUser… |
CVE-2025-4747 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ip_s… |
CVE-2025-4729 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-32702 | High | 7.8 | 2025-05-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally. |
CVE-2024-55466 | Medium | 6.5 | 2025-05-12 | An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to… |
CVE-2025-44176 | Medium | 6.5 | 2025-05-12 | Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function. |
CVE-2025-29509 | High | 8.8 | 2025-05-09 | Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external websit… |
CVE-2024-12442 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access. |
CVE-2024-11861 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access. |
CVE-2025-4454 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04. It has been declared as critical. This vulnerability affects the function wake_on_lan. The manipulation o… |
CVE-2025-4453 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argumen… |
CVE-2025-4445 | Medium | 6.3 | 2025-05-09 | A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac le… |
CVE-2025-4443 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argume… |
CVE-2025-45798 | Critical | 9.8 | 2025-05-08 | A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the… |
CVE-2025-44023 | Medium | 6.5 | 2025-05-08 | An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_admin_pw components. |
CVE-2023-51295 | Medium | 6.5 | 2025-05-08 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_ap… |
CVE-2025-31644 | High | 8.7 | 2025-05-07 | When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow a… |
CVE-2025-29154 | Medium | 6.5 | 2025-05-07 | HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted/solicitacao_treina… |
CVE-2025-46816 | Critical | 9.4 | 2025-05-06 | goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone t… |
CVE-2025-46735 | | 2025-05-06 | Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Prov… | |
CVE-2025-26262 | Medium | 6.5 | 2025-05-06 | An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and execute arbitrary code… |
CVE-2025-22476 | Medium | 5.5 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection… |
CVE-2025-45492 | Critical | 9.8 | 2025-05-06 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function. |
CVE-2025-45491 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter. |
CVE-2025-45490 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter. |
CVE-2025-45489 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter. |
CVE-2025-45488 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter. |
CVE-2025-45487 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function. |
CVE-2025-4357 | Medium | 4.7 | 2025-05-06 | A vulnerability was found in Tenda RX3 16.03.13.11_multi. It has been rated as critical. This issue affects some unknown processing of the file /goform/telnet… |
CVE-2025-4350 | High | 8.8 | 2025-05-06 | A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01. This vulnerability affects the function wake_on_lan. The manipulation of the… |
CVE-2025-4349 | High | 8.8 | 2025-05-06 | A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument… |
CVE-2025-4341 | Medium | 6.3 | 2025-05-06 | A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdoc… |
CVE-2025-4340 | Medium | 6.3 | 2025-05-06 | A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /h… |
CVE-2025-43844 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-43843 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-43842 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2024-57235 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57234 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps functi… |
CVE-2024-57233 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57232 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode f… |
CVE-2024-57231 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fu… |
CVE-2024-57230 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fu… |
CVE-2024-57229 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2025-45042 | Critical | 9.8 | 2025-05-05 | Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. |
CVE-2025-25504 | Medium | 6.5 | 2025-05-05 | An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connec… |
CVE-2025-45800 | Critical | 9.8 | 2025-05-02 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, s… |
CVE-2025-44877 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerabil… |
CVE-2025-44872 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnera… |
CVE-2025-44868 | Critical | 9.8 | 2025-05-02 | Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vuln… |
CVE-2025-46625 | High | 8.8 | 2025-05-01 | Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to… |
CVE-2025-44867 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerabilit… |
CVE-2025-44866 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows… |
CVE-2025-44865 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allow… |
CVE-2025-44864 | Medium | 6.3 | 2025-05-01 | Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allow… |
CVE-2025-44863 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerabi… |
CVE-2025-44862 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vu… |
CVE-2025-44861 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url paramete… |
CVE-2025-44860 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerab… |
CVE-2025-44848 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerab… |
CVE-2025-44847 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This… |
CVE-2025-44846 | Medium | 6.3 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This v… |
CVE-2025-44845 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This… |
CVE-2025-44844 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vu… |
CVE-2025-44843 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url paramet… |
CVE-2025-44842 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnera… |
CVE-2025-44841 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version par… |
CVE-2025-44840 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn paramet… |
CVE-2025-44839 | Medium | 6.5 | 2025-05-01 | TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid par… |
CVE-2025-44838 | Medium | 6.3 | 2025-05-01 | TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName paramete… |
CVE-2025-44837 | Medium | 6.3 | 2025-05-01 | TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or… |
CVE-2025-44836 | Medium | 6.3 | 2025-05-01 | TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute p… |
CVE-2025-44854 | Medium | 6.3 | 2025-05-01 | TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vul… |
CVE-2025-44835 | Medium | 6.3 | 2025-05-01 | D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbitrary commands via s… |
CVE-2025-4135 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulatio… |
CVE-2025-4122 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of… |
CVE-2025-4121 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The ma… |
CVE-2025-45011 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows r… |
CVE-2025-45010 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerab… |
CVE-2025-45009 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remo… |
CVE-2025-4076 | Medium | 6.3 | 2025-04-29 | A vulnerability classified as critical has been found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function easy_uci_set_option_string_0 of the file /cg… |
CVE-2025-4089 | Medium | 5.1 | 2025-04-29 | Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading t… |
CVE-2025-4032 | Medium | 5.0 | 2025-04-28 | A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function… |
CVE-2025-3987 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/for… |
CVE-2025-3983 | Medium | 4.7 | 2025-04-27 | A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-43858 | Critical | 9.2 | 2025-04-24 | YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe c… |
CVE-2025-28017 | Medium | 6.5 | 2025-04-23 | TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter. |
CVE-2025-29743 | Medium | 6.5 | 2025-04-22 | D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting. |
CVE-2025-43948 | High | 7.3 | 2025-04-22 | Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier (such as for sorting), which… |
CVE-2024-40445 | High | 7.3 | 2025-04-22 | A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulati… |
CVE-2025-3816 | Medium | 4.7 | 2025-04-19 | A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the co… |
CVE-2025-29209 | Critical | 9.8 | 2025-04-18 | TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi. |
CVE-2024-46089 | Medium | 6.3 | 2025-04-18 | 74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin. |
CVE-2025-43012 | High | 8.3 | 2025-04-17 | In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible |
CVE-2025-3729 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |