CWE-78 · OS Command Injection (page 18)
Page 18 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37126 | High | 7.2 | 2025-09-16 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary c… |
CVE-2025-34187 | High | 8.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If… |
CVE-2025-34186 | Critical | 9.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for au… |
CVE-2025-34184 | Critical | 9.8 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers… |
CVE-2025-55211 | High | 8.8 | 2025-09-15 | FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) c… |
CVE-2025-59377 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is u… |
CVE-2025-59361 | Critical | 9.8 | 2025-09-15 | The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated i… |
CVE-2025-59360 | Critical | 9.8 | 2025-09-15 | The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated i… |
CVE-2025-59359 | Critical | 9.8 | 2025-09-15 | The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cl… |
CVE-2025-10442 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of… |
CVE-2025-10441 | Medium | 6.3 | 2025-09-15 | A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file versio… |
CVE-2025-10440 | Medium | 6.3 | 2025-09-15 | A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerab… |
CVE-2025-10359 | High | 7.3 | 2025-09-13 | A vulnerability was detected in Wavlink WL-WN578W2 221110. This impacts the function sub_404DBC of the file /cgi-bin/wireless.cgi. The manipulation of the argu… |
CVE-2025-10358 | High | 7.3 | 2025-09-13 | A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub_404850 of the file /cgi-bin/wireless.cgi. The manipulati… |
CVE-2025-10328 | Medium | 6.3 | 2025-09-12 | A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/a… |
CVE-2025-10327 | Medium | 6.3 | 2025-09-12 | A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/pla… |
CVE-2025-10326 | Medium | 6.3 | 2025-09-12 | A security flaw has been discovered in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/api/playlist/single.php. Perf… |
CVE-2025-27234 | | 2025-09-12 | Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl comm… | |
CVE-2025-10265 | High | 8.8 | 2025-09-12 | Certain models of NVR developed by Digiever has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands… |
CVE-2025-54123 | Critical | 9.8 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulne… |
CVE-2025-43885 | High | 7.8 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comman… |
CVE-2025-43884 | High | 8.2 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comman… |
CVE-2025-56413 | High | 8.8 | 2025-09-10 | OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /… |
CVE-2025-9997 | | 2025-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in B… | |
CVE-2025-9996 | | 2025-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any s… | |
CVE-2025-58763 | High | 8.0 | 2025-09-09 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers… |
CVE-2025-54084 | | 2025-09-09 | OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials… | |
CVE-2025-23344 | High | 7.3 | 2025-09-09 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to run code on the platform host as a non-privileged user. A successful exploit of thi… |
CVE-2025-58180 | High | 8.8 | 2025-09-09 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows a… |
CVE-2025-55048 | Critical | 9.8 | 2025-09-09 | Multiple CWE-78 |
CVE-2024-45325 | Medium | 6.7 | 2025-09-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 th… |
CVE-2025-54994 | | 2025-09-08 | @akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way th… | |
CVE-2025-58374 | High | 7.8 | 2025-09-06 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do n… |
CVE-2025-58371 | Critical | 9.8 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request m… |
CVE-2025-58370 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic wher… |
CVE-2025-55037 | Critical | 9.8 | 2025-09-05 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnera… |
CVE-2025-56803 | High | 8.4 | 2025-09-03 | Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands… |
CVE-2025-56498 | Medium | 5.3 | 2025-09-03 | An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user in… |
CVE-2025-8613 | High | 7.2 | 2025-09-02 | Vacron Camera ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2025-9573 | | 2025-09-02 | The ns_backup extension through 13.0.2 for TYPO3 allows command injection. | |
CVE-2025-57799 | | 2025-09-01 | StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify… | |
CVE-2025-54857 | Critical | 9.8 | 2025-09-01 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If ex… |
CVE-2025-9752 | High | 7.3 | 2025-09-01 | A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgi_main of the file soap.cgi of the component SOAP Servi… |
CVE-2025-9745 | Medium | 4.7 | 2025-08-31 | A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the… |
CVE-2025-9727 | Medium | 6.3 | 2025-08-31 | A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgi_main of the file /soap.cgi. This manipulation of the a… |
CVE-2009-20011 | | 2025-08-30 | ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of… | |
CVE-2009-20010 | | 2025-08-30 | Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from… | |
CVE-2005-10004 | High | 8.8 | 2025-08-30 | Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell… |
CVE-2024-46484 | Critical | 9.8 | 2025-08-29 | TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component. |
CVE-2025-9377 | High | 7.2 | 2025-08-29 | The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This… |
CVE-2025-44015 | High | 8.4 | 2025-08-29 | A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerab… |
CVE-2025-30264 | High | 8.8 | 2025-08-29 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then… |
CVE-2025-29887 | High | 7.2 | 2025-08-29 | A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vu… |
CVE-2025-53508 | High | 7.2 | 2025-08-29 | Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive in… |
CVE-2025-58062 | | 2025-08-28 | LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlle… | |
CVE-2025-9580 | Medium | 6.3 | 2025-08-28 | A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Ha… |
CVE-2025-9579 | Medium | 6.3 | 2025-08-28 | A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP… |
CVE-2025-9575 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue… |
CVE-2025-58059 | Critical | 9.1 | 2025-08-28 | Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can… |
CVE-2025-55583 | Critical | 9.8 | 2025-08-28 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endp… |
CVE-2025-34160 | | 2025-08-27 | AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/… | |
CVE-2024-13985 | | 2025-08-27 | A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the… | |
CVE-2018-25115 | Critical | 9.8 | 2025-08-27 | Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability… |
CVE-2025-34161 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows aut… |
CVE-2025-20295 | Medium | 6.0 | 2025-08-27 | A vulnerability in the CLI of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to read or create a file o… |
CVE-2025-20294 | Medium | 6.5 | 2025-08-27 | Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with adminis… |
CVE-2025-20292 | Medium | 4.4 | 2025-08-27 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operati… |
CVE-2025-50989 | Critical | 9.1 | 2025-08-27 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span P… |
CVE-2025-9528 | Medium | 4.7 | 2025-08-27 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing… |
CVE-2025-50974 | Medium | 6.5 | 2025-08-26 | The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter v… |
CVE-2025-9424 | Medium | 4.7 | 2025-08-25 | A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Affected by this vulnerability is an unknown functionality of the file /itbox_pi/branch_import.ph… |
CVE-2025-9387 | Medium | 6.3 | 2025-08-24 | A vulnerability was found in DCN DCME-720 9.1.5.11. This affects an unknown function of the file /usr/local/www/function/audit/newstatistics/ip_block.php of th… |
CVE-2025-57771 | High | 8.1 | 2025-08-22 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitu… |
CVE-2025-3128 | Critical | 9.8 | 2025-08-21 | A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information… |
CVE-2025-9262 | Medium | 5.6 | 2025-08-20 | A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handl… |
CVE-2025-9244 | Medium | 6.3 | 2025-08-20 | A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001… |
CVE-2025-6183 | | 2025-08-20 | The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious… | |
CVE-2025-6181 | | 2025-08-20 | The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation. | |
CVE-2011-10026 | Critical | 9.8 | 2025-08-20 | Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows att… |
CVE-2010-20059 | | 2025-08-20 | FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd paramet… | |
CVE-2025-9176 | Medium | 5.3 | 2025-08-20 | A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Hand… |
CVE-2025-9174 | Medium | 5.3 | 2025-08-19 | A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src/shc.c of the component Filename Handle… |
CVE-2025-55589 | Medium | 6.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters… |
CVE-2025-55284 | High | 7.5 | 2025-08-16 | Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file c… |
CVE-2025-9026 | High | 7.3 | 2025-08-15 | A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Di… |
CVE-2025-20220 | Medium | 6.0 | 2025-08-14 | A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an aut… |
CVE-2025-8876 | High | 8.8 | 2025-08-14 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
CVE-2025-43984 | Critical | 9.8 | 2025-08-14 | An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unaut… |
CVE-2012-10059 | | 2025-08-13 | Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php… | |
CVE-2011-10017 | | 2025-08-13 | Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitiz… | |
CVE-2025-43989 | Medium | 6.5 | 2025-08-13 | The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the… |
CVE-2025-50946 | Medium | 6.5 | 2025-08-13 | OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go. |
CVE-2025-23294 | High | 7.8 | 2025-08-13 | NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions. A successful exploit of… |
CVE-2025-54382 | Critical | 9.6 | 2025-08-13 | Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry… |
CVE-2025-54074 | Critical | 9.8 | 2025-08-13 | Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection d… |
CVE-2025-49813 | High | 7.2 | 2025-08-12 | An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and bef… |
CVE-2025-47857 | Medium | 6.7 | 2025-08-12 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 thro… |
CVE-2025-27759 | Medium | 6.7 | 2025-08-12 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through… |
CVE-2025-25256 | Critical | 9.8 | 2025-08-12 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0… |
CVE-2012-10040 | | 2025-08-11 | Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose cons… |