CWE-78 · OS Command Injection (page 12)
Page 12 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67041 | Critical | 9.8 | 2026-03-11 | An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This… |
CVE-2024-14026 | High | 7.8 | 2026-03-11 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also g… |
CVE-2026-23816 | High | 7.2 | 2026-03-11 | A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying o… |
CVE-2026-28292 | Critical | 9.8 | 2026-03-10 | `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypas… |
CVE-2026-25836 | High | 7.2 | 2026-03-10 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox… |
CVE-2025-66178 | High | 7.2 | 2026-03-10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7… |
CVE-2025-41709 | Critical | 9.8 | 2026-03-10 | An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device. |
CVE-2026-26982 | Medium | 6.3 | 2026-03-10 | Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute… |
CVE-2026-25041 | High | 7.2 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell c… |
CVE-2025-70039 | Critical | 9.8 | 2026-03-09 | An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223. |
CVE-2025-15568 | High | 8.0 | 2026-03-09 | A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access ma… |
CVE-2026-3696 | High | 7.3 | 2026-03-08 | A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-30861 | Critical | 9.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenti… |
CVE-2026-25070 | Critical | 9.8 | 2026-03-07 | XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that… |
CVE-2026-29783 | High | 7.8 | 2026-03-06 | The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion pa… |
CVE-2026-29058 | Critical | 9.8 | 2026-03-06 | AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting she… |
CVE-2026-28507 | High | 7.2 | 2026-03-06 | Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and template path tr… |
CVE-2026-28470 | Critical | 9.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary comma… |
CVE-2026-28463 | High | 8.4 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tok… |
CVE-2026-28391 | Critical | 9.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allo… |
CVE-2026-28287 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilit… |
CVE-2026-28209 | High | 7.2 | 2026-03-05 | FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exist… |
CVE-2026-20008 | Medium | 6.0 | 2026-03-04 | A vulnerability in a small subset of CLI commands that are used on Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall T… |
CVE-2026-26478 | Critical | 9.8 | 2026-03-04 | A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP da… |
CVE-2025-59783 | High | 7.2 | 2026-03-04 | API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This… |
CVE-2026-27441 | Critical | 9.8 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution. |
CVE-2026-28774 | High | 8.8 | 2026-03-04 | An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex… |
CVE-2026-28773 | High | 8.8 | 2026-03-04 | The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Manageme… |
CVE-2026-26279 | Critical | 9.1 | 2026-03-03 | Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email fo… |
CVE-2026-3485 | Critical | 9.8 | 2026-03-03 | A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes… |
CVE-2025-13688 | Medium | 6.3 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the syst… |
CVE-2025-13687 | Medium | 6.3 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the syst… |
CVE-2025-13686 | Medium | 6.3 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the syst… |
CVE-2024-55021 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. |
CVE-2024-55020 | Critical | 9.8 | 2026-03-03 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute a… |
CVE-2025-67840 | High | 7.2 | 2026-03-03 | Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_… |
CVE-2025-63911 | High | 7.2 | 2026-03-03 | Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability. |
CVE-2026-0654 | High | 8.0 | 2026-03-02 | Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authent… |
CVE-2026-24101 | Critical | 9.8 | 2026-03-02 | An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenat… |
CVE-2025-50197 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via… |
CVE-2025-50196 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php vi… |
CVE-2025-50195 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.p… |
CVE-2025-50194 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This… |
CVE-2025-50193 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the… |
CVE-2025-30044 | | 2026-03-02 | In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl"… | |
CVE-2026-28517 | Critical | 9.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot'… |
CVE-2026-28417 | Medium | 4.4 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled… |
CVE-2026-28409 | Critical | 10.0 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA applicatio… |
CVE-2026-21654 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows O… |
CVE-2026-0980 | High | 8.3 | 2026-02-27 | A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creat… |
CVE-2026-3301 | Critical | 9.8 | 2026-02-27 | A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/c… |
CVE-2026-3037 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-25721 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-25196 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-25105 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution o… |
CVE-2026-25037 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on th… |
CVE-2026-24452 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on th… |
CVE-2026-23702 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-20764 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-25195 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on… |
CVE-2026-25111 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-25109 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on t… |
CVE-2026-24695 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on… |
CVE-2026-24689 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on th… |
CVE-2026-24663 | Critical | 9.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on t… |
CVE-2026-24517 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on t… |
CVE-2026-21389 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-20910 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the… |
CVE-2026-20902 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on… |
CVE-2026-20742 | High | 8.0 | 2026-02-27 | An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on th… |
CVE-2026-28279 | High | 7.3 | 2026-02-26 | osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration… |
CVE-2026-28269 | Medium | 5.9 | 2026-02-26 | Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to re… |
CVE-2026-28207 | Medium | 6.6 | 2026-02-26 | Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.2, a command injection vulnerability (CWE-78) in the Ze… |
CVE-2026-27965 | Critical | 9.9 | 2026-02-26 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storag… |
CVE-2026-27938 | High | 7.7 | 2026-02-26 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`relea… |
CVE-2026-27635 | High | 7.5 | 2026-02-26 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0… |
CVE-2026-27613 | Critical | 9.8 | 2026-02-25 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass… |
CVE-2026-27849 | Critical | 9.8 | 2026-02-25 | Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for… |
CVE-2026-27728 | Critical | 9.9 | 2026-02-25 | OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.perf… |
CVE-2026-20099 | Medium | 6.7 | 2026-02-25 | A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker w… |
CVE-2026-20036 | Medium | 6.5 | 2026-02-25 | A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with valid administra… |
CVE-2026-27848 | Critical | 9.8 | 2026-02-25 | Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimately run as the root… |
CVE-2026-27626 | Critical | 9.9 | 2026-02-25 | OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkS… |
CVE-2026-22553 | Critical | 9.8 | 2026-02-24 | All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the v… |
CVE-2026-23678 | High | 8.8 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function… |
CVE-2026-3102 | Medium | 6.3 | 2026-02-24 | A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the co… |
CVE-2026-3101 | Medium | 6.3 | 2026-02-24 | A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping Handler. The manipulation results in os… |
CVE-2026-27208 | Critical | 9.2 | 2026-02-24 | bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege E… |
CVE-2026-26331 | High | 8.8 | 2026-02-24 | yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line optio… |
CVE-2026-1459 | High | 7.2 | 2026-02-24 | A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(A… |
CVE-2025-13943 | High | 8.8 | 2026-02-24 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could a… |
CVE-2025-13942 | Critical | 9.8 | 2026-02-24 | A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to exec… |
CVE-2026-3040 | Medium | 4.7 | 2026-02-23 | A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of t… |
CVE-2025-70328 | High | 8.8 | 2026-02-23 | TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The h… |
CVE-2025-70329 | High | 8.0 | 2026-02-23 | TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlan… |
CVE-2026-2952 | High | 7.3 | 2026-02-22 | A flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request Handler. T… |
CVE-2026-2944 | High | 7.3 | 2026-02-22 | A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php… |
CVE-2026-27487 | High | 7.6 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell com… |
CVE-2026-26046 | High | 7.2 | 2026-02-21 | A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. O… |
CVE-2026-2043 | High | 8.8 | 2026-02-20 | Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |