CWE-78 · OS Command Injection (page 20)
Page 20 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29631 | Critical | 9.8 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through… |
CVE-2014-125118 | | 2025-07-25 | A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter whe… | |
CVE-2019-25224 | Critical | 9.8 | 2025-07-25 | The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows… |
CVE-2025-7404 | Critical | 9.8 | 2025-07-24 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command In… |
CVE-2025-5243 | Critical | 10.0 | 2025-07-24 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SM… |
CVE-2022-4978 | | 2025-07-23 | Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default co… | |
CVE-2015-10141 | | 2025-07-23 | An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. W… | |
CVE-2025-41684 | High | 8.8 | 2025-07-23 | An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in th… |
CVE-2025-41683 | High | 8.8 | 2025-07-23 | An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in th… |
CVE-2024-53286 | High | 7.2 | 2025-07-23 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manage… |
CVE-2025-43020 | Medium | 6.8 | 2025-07-22 | A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a priv… |
CVE-2025-54072 | High | 7.5 | 2025-07-22 | yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default plac… |
CVE-2025-7724 | | 2025-07-22 | An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1… | |
CVE-2025-7723 | | 2025-07-22 | A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NV… | |
CVE-2025-34143 | | 2025-07-22 | An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user… | |
CVE-2025-53472 | High | 7.2 | 2025-07-22 | WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If e… |
CVE-2025-36846 | Critical | 9.8 | 2025-07-21 | An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that… |
CVE-2025-46117 | Critical | 9.1 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hi… |
CVE-2025-7382 | High | 8.8 | 2025-07-21 | A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code e… |
CVE-2025-6704 | Critical | 9.8 | 2025-07-21 | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth… |
CVE-2025-41675 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralizatio… |
CVE-2025-41674 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special el… |
CVE-2025-41673 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elem… |
CVE-2025-24938 | High | 8.4 | 2025-07-21 | The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (adm… |
CVE-2025-24936 | Critical | 9.0 | 2025-07-21 | The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the net… |
CVE-2025-54314 | Low | 2.8 | 2025-07-20 | Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only… |
CVE-2025-7788 | Medium | 6.3 | 2025-07-18 | A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of t… |
CVE-2025-34132 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NT… | |
CVE-2025-34129 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitizati… | |
CVE-2025-34125 | | 2025-07-16 | An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B… | |
CVE-2025-34117 | | 2025-07-16 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an… | |
CVE-2025-52379 | Medium | 5.4 | 2025-07-15 | Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature. The… |
CVE-2025-34116 | | 2025-07-15 | A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can… | |
CVE-2025-34115 | | 2025-07-15 | An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A us… | |
CVE-2025-34113 | | 2025-07-15 | An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `t… | |
CVE-2025-34112 | | 2025-07-15 | An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL in… | |
CVE-2025-34103 | | 2025-07-15 | An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undo… | |
CVE-2025-53818 | | 2025-07-14 | GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Versi… | |
CVE-2025-53623 | | 2025-07-14 | The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vul… | |
CVE-2025-7451 | Critical | 9.8 | 2025-07-14 | The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execu… |
CVE-2025-7553 | Medium | 4.7 | 2025-07-14 | A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The m… |
CVE-2013-3307 | High | 8.3 | 2025-07-11 | Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the… |
CVE-2025-52988 | Medium | 6.7 | 2025-07-11 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos O… |
CVE-2025-52994 | Medium | 4.9 | 2025-07-11 | gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709. |
CVE-2025-50121 | | 2025-07-11 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remo… | |
CVE-2025-53637 | Medium | 4.1 | 2025-07-10 | Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive per… |
CVE-2025-7414 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPi… |
CVE-2025-34102 | | 2025-07-10 | A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command inj… | |
CVE-2025-34101 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed… | |
CVE-2025-34099 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when pa… | |
CVE-2025-34095 | | 2025-07-10 | An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp… | |
CVE-2025-34093 | | 2025-07-10 | An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in… | |
CVE-2025-53542 | High | 7.7 | 2025-07-10 | Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of… |
CVE-2025-46334 | High | 8.6 | 2025-07-10 | Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter prog… |
CVE-2025-27614 | High | 8.6 | 2025-07-10 | Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who ha… |
CVE-2025-27613 | Low | 3.6 | 2025-07-10 | Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments… |
CVE-2025-7407 | Medium | 6.3 | 2025-07-10 | A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of… |
CVE-2025-6514 | Critical | 9.6 | 2025-07-09 | mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL |
CVE-2025-3499 | Critical | 10.0 | 2025-07-09 | The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection throu… |
CVE-2025-49537 | High | 7.9 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje… |
CVE-2025-6771 | High | 7.2 | 2025-07-08 | OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high p… |
CVE-2025-6770 | High | 7.2 | 2025-07-08 | OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve re… |
CVE-2025-25269 | High | 8.4 | 2025-07-08 | An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation. |
CVE-2025-7154 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the… |
CVE-2025-20319 | Medium | 6.8 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `l… |
CVE-2025-53376 | High | 8.8 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-priv… |
CVE-2025-3705 | Medium | 6.8 | 2025-07-07 | A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('… |
CVE-2025-3626 | Critical | 9.1 | 2025-07-07 | A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS… |
CVE-2025-48501 | Critical | 9.8 | 2025-07-07 | An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed… |
CVE-2025-7145 | High | 7.2 | 2025-07-07 | ThreatSonar Anti-Ransomware developed by TeamT5 has an OS Command Injection vulnerability, allowing remote attackers with product platform intermediate privile… |
CVE-2025-7097 | High | 8.1 | 2025-07-06 | A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing o… |
CVE-2025-7083 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp of the component w… |
CVE-2025-7082 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/… |
CVE-2025-7081 | Medium | 6.3 | 2025-07-06 | A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the fil… |
CVE-2025-47228 | Medium | 6.7 | 2025-07-05 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attack… |
CVE-2025-34088 | High | 8.8 | 2025-07-03 | An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated user… |
CVE-2025-34087 | High | 8.8 | 2025-07-03 | An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain… |
CVE-2025-34082 | | 2025-07-03 | A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to i… | |
CVE-2025-20308 | Medium | 6.0 | 2025-07-02 | A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying o… |
CVE-2025-34073 | | 2025-07-02 | An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating sy… | |
CVE-2025-53100 | | 2025-07-01 | RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable t… | |
CVE-2025-34056 | | 2025-07-01 | An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management ope… | |
CVE-2025-34055 | | 2025-07-01 | An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD dae… | |
CVE-2025-34054 | | 2025-07-01 | An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization all… | |
CVE-2025-26074 | Critical | 9.8 | 2025-06-30 | Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. |
CVE-2025-6899 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file m… |
CVE-2025-6898 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6897 | Medium | 5.5 | 2025-06-30 | A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_d… |
CVE-2025-6896 | Medium | 6.3 | 2025-06-30 | A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulati… |
CVE-2023-28906 | High | 7.8 | 2025-06-28 | A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain ad… |
CVE-2025-36529 | High | 7.2 | 2025-06-27 | An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. If this vulnerability is exploited, an arbitrary OS co… |
CVE-2025-34049 | | 2025-06-26 | An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web… | |
CVE-2025-34044 | | 2025-06-26 | A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET reques… | |
CVE-2025-34043 | | 2025-06-26 | A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script… | |
CVE-2025-34042 | | 2025-06-26 | An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters… | |
CVE-2025-52573 | Medium | 6.0 | 2025-06-26 | iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators. Versions prior to 1.3.3 are written… |
CVE-2025-6562 | High | 8.8 | 2025-06-26 | Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privi… |
CVE-2025-5459 | High | 8.8 | 2025-06-26 | A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It a… |
CVE-2025-6621 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulatio… |
CVE-2025-6620 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upg… |