CWE-78 · OS Command Injection (page 20)
Page 20 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-25143 | High | 8.8 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. At… |
CVE-2025-43876 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-43875 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-66213 | High | 8.8 | 2025-12-23 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command i… |
CVE-2025-66212 | High | 8.8 | 2025-12-23 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command i… |
CVE-2025-66211 | High | 8.8 | 2025-12-23 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command i… |
CVE-2025-66210 | High | 8.8 | 2025-12-23 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command i… |
CVE-2025-66209 | Critical | 9.9 | 2025-12-23 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command i… |
CVE-2025-14500 | Critical | 9.8 | 2025-12-23 | IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2025-13700 | High | 7.2 | 2025-12-23 | DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2023-53981 | High | 7.2 | 2025-12-22 | PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through the exiftran path co… |
CVE-2023-53963 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell comma… |
CVE-2023-53948 | Critical | 9.8 | 2025-12-19 | Lilac-Reloaded for Nagios 2.0.8 contains a remote code execution vulnerability in the autodiscovery feature that allows attackers to inject arbitrary commands… |
CVE-2023-53945 | High | 8.8 | 2025-12-19 | BrainyCP 1.0 contains an authenticated remote code execution vulnerability that allows logged-in users to inject arbitrary commands through the crontab configu… |
CVE-2025-11774 | High | 8.2 | 2025-12-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referre… |
CVE-2023-53941 | Critical | 9.8 | 2025-12-18 | EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting m… |
CVE-2025-14737 | High | 8.0 | 2025-12-18 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA… |
CVE-2025-65008 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious att… | |
CVE-2025-68459 | High | 7.2 | 2025-12-18 | RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS com… |
CVE-2025-68109 | Critical | 9.1 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file exte… |
CVE-2025-67172 | High | 7.2 | 2025-12-17 | RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function. |
CVE-2025-67164 | Critical | 9.9 | 2025-12-17 | An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via up… |
CVE-2025-43873 | | 2025-12-17 | Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device. | |
CVE-2025-68154 | High | 8.1 | 2025-12-16 | systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable… |
CVE-2025-63414 | Critical | 10.0 | 2025-12-16 | A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By… |
CVE-2025-65074 | High | 7.2 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2023-53872 | | 2025-12-15 | Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers… | |
CVE-2025-14586 | Medium | 6.3 | 2025-12-13 | A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?acti… |
CVE-2024-58314 | High | 8.8 | 2025-12-12 | Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attacke… |
CVE-2024-14010 | Critical | 9.8 | 2025-12-12 | Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can… |
CVE-2024-58294 | High | 8.8 | 2025-12-11 | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbi… |
CVE-2024-58287 | High | 8.8 | 2025-12-11 | reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute… |
CVE-2024-58286 | | 2025-12-11 | dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. A… | |
CVE-2025-13481 | High | 8.8 | 2025-12-11 | IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to impro… |
CVE-2025-56130 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to… |
CVE-2025-56129 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnos… |
CVE-2025-56127 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the get_wanobj in… |
CVE-2025-56124 | High | 7.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST req… |
CVE-2025-56123 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a craft… |
CVE-2025-56122 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST… |
CVE-2025-56120 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST req… |
CVE-2025-56118 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST req… |
CVE-2025-56117 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the mod… |
CVE-2025-56114 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to t… |
CVE-2025-56113 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a crafted P… |
CVE-2025-56111 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wa… |
CVE-2025-56110 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_deal_up… |
CVE-2025-56109 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_wireles… |
CVE-2025-56108 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwd… |
CVE-2025-56107 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the submit_wifi i… |
CVE-2025-56106 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request… |
CVE-2025-56102 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request… |
CVE-2025-56101 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to t… |
CVE-2025-56099 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the… |
CVE-2025-56098 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the mod… |
CVE-2025-56097 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST… |
CVE-2025-56096 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modul… |
CVE-2025-56095 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a craft… |
CVE-2025-56094 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the mod… |
CVE-2025-56093 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the set… |
CVE-2025-56092 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the… |
CVE-2025-56091 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request… |
CVE-2025-56090 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a craft… |
CVE-2025-56089 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to t… |
CVE-2025-56088 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service… |
CVE-2025-56087 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump i… |
CVE-2025-56086 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a c… |
CVE-2025-56085 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a c… |
CVE-2025-56084 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST… |
CVE-2025-56083 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the mod… |
CVE-2025-56082 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the check_changes… |
CVE-2025-56079 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request t… |
CVE-2025-56077 | High | 8.8 | 2025-12-11 | OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_s… |
CVE-2025-67738 | High | 8.5 | 2025-12-11 | squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are availa… |
CVE-2025-65199 | High | 7.8 | 2025-12-10 | A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitr… |
CVE-2025-67640 | Medium | 5.0 | 2025-12-10 | Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell scrip… |
CVE-2025-66626 | High | 8.1 | 2025-12-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 t… |
CVE-2021-47728 | Critical | 9.8 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell… |
CVE-2025-65882 | Critical | 9.8 | 2025-12-09 | An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad al… |
CVE-2025-64153 | High | 7.2 | 2025-12-09 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0… |
CVE-2025-53949 | High | 7.2 | 2025-12-09 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0… |
CVE-2025-53679 | High | 7.2 | 2025-12-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0… |
CVE-2025-14204 | Medium | 6.3 | 2025-12-07 | A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-au… |
CVE-2025-66644 | High | 7.2 | 2025-12-05 | Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. |
CVE-2020-36877 | | 2025-12-05 | ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands… | |
CVE-2025-14094 | Medium | 4.7 | 2025-12-05 | A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the a… |
CVE-2025-14093 | Medium | 4.7 | 2025-12-05 | A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulati… |
CVE-2025-14092 | Medium | 4.7 | 2025-12-05 | A security vulnerability has been detected in Edimax BR-6478AC V3 1.0.15. This issue affects the function sub_416898 of the file /boafrm/formDebugDiagnosticRun… |
CVE-2025-66576 | Critical | 9.8 | 2025-12-04 | Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code… |
CVE-2025-66572 | | 2025-12-04 | Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary… | |
CVE-2024-58278 | | 2025-12-04 | perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can co… | |
CVE-2025-29269 | Critical | 9.8 | 2025-12-04 | ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint. |
CVE-2025-66208 | Critical | 9.8 | 2025-12-03 | Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versio… |
CVE-2025-34319 | | 2025-12-03 | TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability… | |
CVE-2025-12744 | High | 8.8 | 2025-12-03 | A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them direc… |
CVE-2025-11787 | High | 8.8 | 2025-12-02 | Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' funct… |
CVE-2025-66401 | Critical | 9.8 | 2025-12-01 | MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command… |
CVE-2025-35028 | Critical | 9.1 | 2025-11-30 | By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP serve… |
CVE-2025-8890 | | 2025-11-27 | Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploi… | |
CVE-2025-65202 | High | 8.0 | 2025-11-26 | TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command… |