CWE-78 · OS Command Injection (page 19)
Page 19 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2012-10039 | | 2025-08-11 | ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtic… | |
CVE-2012-10037 | | 2025-08-11 | PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without… | |
CVE-2025-8830 | Medium | 6.3 | 2025-08-11 | A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of… |
CVE-2025-8829 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_r… |
CVE-2025-8828 | Medium | 6.3 | 2025-08-11 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /gofor… |
CVE-2025-8827 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function um_inspect_cross_band of… |
CVE-2025-8825 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function RP_setBasicAuto of the fi… |
CVE-2025-8823 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setDevice… |
CVE-2025-8821 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function RP_setBasic of the… |
CVE-2025-8818 | Medium | 6.3 | 2025-08-10 | A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSettin… |
CVE-2012-10046 | | 2025-08-08 | The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi scr… | |
CVE-2012-10041 | | 2025-08-08 | WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc P… | |
CVE-2010-10013 | | 2025-08-08 | An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkI… | |
CVE-2025-8748 | High | 8.8 | 2025-08-08 | MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user coul… |
CVE-2025-54958 | Medium | 6.3 | 2025-08-08 | Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be… |
CVE-2024-58257 | Medium | 5.7 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58256 | Medium | 4.5 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58255 | Medium | 5.0 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2025-8697 | Medium | 6.3 | 2025-08-07 | A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPS… |
CVE-2025-34152 | | 2025-08-07 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '… | |
CVE-2025-34151 | | 2025-08-07 | A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)… | |
CVE-2025-34150 | | 2025-08-07 | The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter… | |
CVE-2025-34149 | | 2025-08-07 | A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is inter… | |
CVE-2025-34148 | | 2025-08-07 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in W… | |
CVE-2025-8667 | Medium | 6.3 | 2025-08-06 | A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the fun… |
CVE-2025-8665 | Medium | 6.3 | 2025-08-06 | A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the l… |
CVE-2025-22469 | High | 7.3 | 2025-08-06 | OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. An arbitrary OS comma… |
CVE-2025-8655 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrar… |
CVE-2025-8654 | High | 8.8 | 2025-08-06 | Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2025-8652 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitra… |
CVE-2025-8651 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitra… |
CVE-2025-8650 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR libSystemLib Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrar… |
CVE-2025-8649 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitra… |
CVE-2025-8648 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8647 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8646 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8645 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8644 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8643 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8642 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8641 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8640 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8639 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8638 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8637 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8636 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8635 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8634 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8633 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8632 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8631 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8630 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8629 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8628 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2013-10069 | Critical | 9.8 | 2025-08-05 | The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vu… |
CVE-2012-10033 | | 2025-08-05 | Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to… | |
CVE-2012-10029 | | 2025-08-05 | Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can i… | |
CVE-2012-10028 | | 2025-08-05 | Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary sy… | |
CVE-2025-43978 | High | 7.4 | 2025-08-05 | Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_… |
CVE-2025-43979 | High | 7.4 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root pr… |
CVE-2025-2611 | | 2025-08-05 | The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that… | |
CVE-2025-54987 | Critical | 9.4 | 2025-08-05 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute co… |
CVE-2025-54948 | Critical | 9.4 | 2025-08-05 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute co… |
CVE-2025-54795 | Critical | 9.8 | 2025-08-05 | Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to… |
CVE-2025-54135 | High | 8.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a… |
CVE-2025-51390 | Critical | 9.8 | 2025-08-04 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function. |
CVE-2025-34147 | | 2025-08-04 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in E… | |
CVE-2025-44961 | Critical | 9.9 | 2025-08-04 | In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. |
CVE-2025-44960 | High | 8.5 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. |
CVE-2025-30099 | High | 7.8 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30098 | Medium | 6.7 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30097 | Medium | 6.7 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30096 | Medium | 6.7 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-36607 | High | 7.8 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially expl… |
CVE-2025-36606 | High | 7.8 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nfssupport utility. An authenticated attacker could potential… |
CVE-2025-36604 | High | 7.3 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-54782 | High | 8.8 | 2025-08-02 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability w… |
CVE-2025-54136 | High | 7.2 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an… |
CVE-2025-54133 | Critical | 9.6 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model… |
CVE-2013-10061 | High | 7.2 | 2025-08-01 | An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the… |
CVE-2013-10060 | High | 7.2 | 2025-08-01 | An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe… |
CVE-2013-10059 | High | 7.2 | 2025-08-01 | An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm… |
CVE-2013-10058 | | 2025-08-01 | An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the appl… | |
CVE-2013-10053 | | 2025-08-01 | A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is pas… | |
CVE-2013-10050 | High | 8.8 | 2025-08-01 | An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_… |
CVE-2013-10049 | | 2025-08-01 | An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHan… | |
CVE-2013-10048 | Critical | 9.8 | 2025-08-01 | An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)… |
CVE-2025-8473 | Medium | 6.6 | 2025-08-01 | Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affect… |
CVE-2025-54595 | High | 7.3 | 2025-08-01 | Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner… |
CVE-2025-50475 | Critical | 9.8 | 2025-07-31 | An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands… |
CVE-2014-125124 | | 2025-07-31 | An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listen… | |
CVE-2013-10039 | | 2025-07-31 | A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to… | |
CVE-2013-10037 | | 2025-07-31 | An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdo… | |
CVE-2025-54430 | Critical | 9.1 | 2025-07-30 | dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit… |
CVE-2025-29534 | High | 8.8 | 2025-07-28 | An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbit… |
CVE-2025-54418 | Critical | 9.8 | 2025-07-28 | CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagi… |
CVE-2025-53695 | | 2025-07-28 | OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device f… | |
CVE-2025-8259 | High | 7.3 | 2025-07-28 | A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_se… |
CVE-2023-53158 | Medium | 4.1 | 2025-07-28 | The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered… |
CVE-2025-54415 | | 2025-07-26 | dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerabi… |