CWE-78 · OS Command Injection (page 16)
Page 16 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36877 | | 2025-12-05 | ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands… | |
CVE-2025-14094 | Medium | 4.7 | 2025-12-05 | A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the a… |
CVE-2025-14093 | Medium | 4.7 | 2025-12-05 | A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulati… |
CVE-2025-14092 | Medium | 4.7 | 2025-12-05 | A security vulnerability has been detected in Edimax BR-6478AC V3 1.0.15. This issue affects the function sub_416898 of the file /boafrm/formDebugDiagnosticRun… |
CVE-2025-66576 | Critical | 9.8 | 2025-12-04 | Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code… |
CVE-2025-66572 | | 2025-12-04 | Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary… | |
CVE-2024-58278 | | 2025-12-04 | perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can co… | |
CVE-2025-29269 | Critical | 9.8 | 2025-12-04 | ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint. |
CVE-2025-66208 | Critical | 9.8 | 2025-12-03 | Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versio… |
CVE-2025-34319 | | 2025-12-03 | TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability… | |
CVE-2025-12744 | High | 8.8 | 2025-12-03 | A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them direc… |
CVE-2025-11787 | High | 8.8 | 2025-12-02 | Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' funct… |
CVE-2025-66401 | Critical | 9.8 | 2025-12-01 | MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command… |
CVE-2025-35028 | Critical | 9.1 | 2025-11-30 | By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP serve… |
CVE-2025-8890 | | 2025-11-27 | Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploi… | |
CVE-2025-65202 | High | 8.0 | 2025-11-26 | TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command… |
CVE-2025-64128 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, wh… |
CVE-2025-64127 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incor… |
CVE-2025-64126 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying… |
CVE-2025-62354 | Critical | 9.8 | 2025-11-26 | Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are… |
CVE-2025-66261 | Critical | 9.8 | 2025-11-26 | Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 10… |
CVE-2025-66253 | Critical | 9.8 | 2025-11-26 | Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000… |
CVE-2025-59370 | | 2025-11-25 | A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbit… | |
CVE-2025-59366 | | 2025-11-25 | An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentia… | |
CVE-2025-12742 | | 2025-11-25 | A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted… | |
CVE-2018-25126 | | 2025-11-24 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS com… | |
CVE-2025-64755 | Critical | 9.8 | 2025-11-21 | Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only val… |
CVE-2025-13087 | Medium | 6.2 | 2025-11-20 | A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a PO… |
CVE-2025-12121 | High | 7.3 | 2025-11-20 | Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell comma… |
CVE-2025-60738 | Critical | 9.8 | 2025-11-20 | An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arb… |
CVE-2025-63932 | High | 7.3 | 2025-11-19 | D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin d… |
CVE-2025-34335 | High | 8.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the lice… |
CVE-2025-34334 | High | 8.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax tes… |
CVE-2025-37163 | High | 7.2 | 2025-11-18 | A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker cou… |
CVE-2025-37158 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37157 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-58034 | High | 7.2 | 2025-11-18 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 t… |
CVE-2025-63408 | High | 7.8 | 2025-11-18 | Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to sensitive informati… |
CVE-2025-8693 | High | 8.8 | 2025-11-18 | A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an a… |
CVE-2025-13306 | Medium | 6.3 | 2025-11-18 | A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formD… |
CVE-2025-64756 | High | 7.5 | 2025-11-17 | Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection… |
CVE-2025-55055 | Medium | 6.8 | 2025-11-17 | CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2025-34322 | High | 7.2 | 2025-11-17 | Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature… |
CVE-2025-63916 | High | 8.1 | 2025-11-17 | MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supp… |
CVE-2025-13284 | Critical | 9.8 | 2025-11-17 | ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute… |
CVE-2021-4470 | | 2025-11-14 | TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a… | |
CVE-2021-4466 | | 2025-11-14 | IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. The email… | |
CVE-2025-64444 | High | 7.2 | 2025-11-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a rem… |
CVE-2025-20349 | Medium | 6.3 | 2025-11-13 | A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container… |
CVE-2025-12763 | Medium | 6.8 | 2025-11-13 | pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup… |
CVE-2025-42892 | Medium | 6.8 | 2025-11-11 | Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could… |
CVE-2025-10230 | Critical | 10.0 | 2025-11-07 | A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or esca… |
CVE-2025-64328 | High | 7.2 | 2025-11-07 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module w… |
CVE-2025-11546 | | 2025-11-07 | CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux… | |
CVE-2025-12489 | High | 7.8 | 2025-11-06 | evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affec… |
CVE-2025-34239 | High | 7.2 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenti… |
CVE-2022-50596 | Critical | 9.8 | 2025-11-06 | D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that… |
CVE-2025-63334 | Critical | 9.8 | 2025-11-05 | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The applicati… |
CVE-2025-45379 | High | 8.4 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell… |
CVE-2025-45378 | Critical | 9.1 | 2025-11-05 | Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of Cl… |
CVE-2025-30479 | High | 8.4 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. |
CVE-2025-61304 | Critical | 9.8 | 2025-11-05 | OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. |
CVE-2025-10622 | High | 8.0 | 2025-11-05 | A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary… |
CVE-2025-64109 | High | 8.8 | 2025-11-05 | Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code… |
CVE-2025-64106 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables speci… |
CVE-2025-11953 | Critical | 9.8 | 2025-11-03 | The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that i… |
CVE-2025-54763 | High | 7.2 | 2025-10-31 | FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the produ… |
CVE-2025-34286 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/e… |
CVE-2025-34284 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an… |
CVE-2025-34280 | High | 7.2 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal o… |
CVE-2025-34134 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validat… |
CVE-2024-14008 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supp… |
CVE-2024-14005 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wiza… |
CVE-2024-14003 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient… |
CVE-2020-36867 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the P… |
CVE-2020-36856 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation… |
CVE-2018-25122 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe comman… |
CVE-2013-10073 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell wit… |
CVE-2025-46423 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-46422 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43942 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43941 | High | 7.2 | 2025-10-30 | Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43940 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43939 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-54941 | Medium | 4.6 | 2025-10-30 | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on w… |
CVE-2025-54469 | Critical | 9.9 | 2025-10-30 | A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be ex… |
CVE-2025-11202 | Critical | 9.8 | 2025-10-29 | win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2018-25120 | Critical | 9.8 | 2025-10-29 | D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality… |
CVE-2025-64140 | High | 8.8 | 2025-10-29 | Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permiss… |
CVE-2025-62801 | High | 7.8 | 2025-10-28 | FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influenc… |
CVE-2025-34312 | High | 8.8 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands a… |
CVE-2025-34311 | High | 8.8 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands a… |
CVE-2025-1038 | | 2025-10-28 | The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high… | |
CVE-2025-1036 | | 2025-10-28 | Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access f… | |
CVE-2025-12296 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handle… |
CVE-2025-60803 | Critical | 9.8 | 2025-10-24 | Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../… |
CVE-2025-10680 | High | 8.8 | 2025-10-24 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown… |
CVE-2025-6978 | High | 7.2 | 2025-10-23 | Diagnostics command injection vulnerability |
CVE-2025-62713 | | 2025-10-23 | Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerab… | |
CVE-2016-15048 | Critical | 9.8 | 2025-10-22 | AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The… |