CWE-78 · OS Command Injection (page 21)
Page 21 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6619 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the… |
CVE-2025-6618 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so… |
CVE-2025-48890 | Critical | 9.8 | 2025-06-24 | WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in miniigd SOAP s… |
CVE-2025-43879 | Critical | 9.8 | 2025-06-24 | WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet fun… |
CVE-2025-41427 | High | 8.8 | 2025-06-24 | WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability… |
CVE-2025-6559 | Critical | 9.8 | 2025-06-24 | Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS comman… |
CVE-2025-34041 | | 2025-06-24 | An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2… | |
CVE-2025-34037 | | 2025-06-24 | An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on po… | |
CVE-2025-34036 | Critical | 9.8 | 2025-06-24 | An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens… |
CVE-2025-34035 | Critical | 9.8 | 2025-06-24 | An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitiz… |
CVE-2025-34033 | High | 8.8 | 2025-06-24 | An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi… |
CVE-2025-2172 | | 2025-06-23 | Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing… | |
CVE-2025-23049 | | 2025-06-23 | Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled. | |
CVE-2025-6485 | Medium | 6.3 | 2025-06-22 | A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /… |
CVE-2025-34030 | | 2025-06-20 | An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-su… | |
CVE-2025-34029 | High | 8.8 | 2025-06-20 | An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSys… |
CVE-2025-34024 | High | 8.8 | 2025-06-20 | An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint impr… |
CVE-2025-25038 | Critical | 9.8 | 2025-06-20 | An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize us… |
CVE-2025-44635 | Critical | 9.8 | 2025-06-20 | There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before… |
CVE-2025-6193 | Medium | 5.9 | 2025-06-20 | A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom reso… |
CVE-2025-6299 | Medium | 4.7 | 2025-06-20 | A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulati… |
CVE-2025-50201 | Critical | 9.8 | 2025-06-19 | WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debu… |
CVE-2025-6104 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/p… |
CVE-2025-6103 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functio… |
CVE-2025-6102 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-39240 | High | 7.2 | 2025-06-13 | Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid creden… |
CVE-2025-4230 | | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | |
CVE-2025-41663 | Critical | 9.8 | 2025-06-11 | For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers… |
CVE-2025-31104 | High | 7.2 | 2025-06-10 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 thr… |
CVE-2024-13089 | High | 7.2 | 2025-06-10 | An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. … |
CVE-2025-5743 | Medium | 5.5 | 2025-06-10 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote control over th… |
CVE-2025-5952 | High | 7.3 | 2025-06-10 | A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php… |
CVE-2025-49141 | High | 8.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string… |
CVE-2025-22481 | High | 8.8 | 2025-06-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-13087 | Medium | 6.7 | 2025-06-06 | A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, t… |
CVE-2011-10007 | High | 8.8 | 2025-06-05 | File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the… |
CVE-2025-49008 | | 2025-06-05 | Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/code… | |
CVE-2025-5621 | High | 7.3 | 2025-06-05 | A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file… |
CVE-2025-5620 | High | 7.3 | 2025-06-05 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 1.10CNB05. Affected is the function setipsec_config of the file /goform/setipsec… |
CVE-2025-5573 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been rated as critical. Affected by this issue is the function setSystemWizard/setSystemControl of… |
CVE-2025-5571 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the file /setSystemAdmin… |
CVE-2025-5525 | Medium | 5.6 | 2025-06-03 | A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/ut… |
CVE-2025-5447 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been dec… |
CVE-2025-5446 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been cla… |
CVE-2025-5445 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified a… |
CVE-2025-5444 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classif… |
CVE-2025-5443 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1… |
CVE-2025-5442 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.00… |
CVE-2025-5441 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2… |
CVE-2025-5440 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003… |
CVE-2025-5439 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rat… |
CVE-2025-41385 | High | 7.2 | 2025-05-30 | An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS command may be executed by a logged-in admini… |
CVE-2025-48047 | | 2025-05-29 | An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint. | |
CVE-2025-5277 | Critical | 9.6 | 2025-05-28 | aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands o… |
CVE-2025-1753 | High | 7.8 | 2025-05-28 | LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument… |
CVE-2023-34873 | | 2025-05-23 | On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated… | |
CVE-2025-5106 | High | 7.3 | 2025-05-23 | A vulnerability was found in Fujian Kelixun 1.0. It has been classified as critical. This affects an unknown part of the file /app/fax/fax_view.php of the comp… |
CVE-2025-47780 | High | 7.8 | 2025-05-22 | Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-… |
CVE-2025-3883 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbit… |
CVE-2025-3882 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to ex… |
CVE-2025-3881 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execu… |
CVE-2025-48069 | Medium | 6.6 | 2025-05-21 | ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability rela… |
CVE-2025-5030 | Medium | 5.0 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file… |
CVE-2025-48204 | Medium | 6.8 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows command injection. |
CVE-2024-42922 | Medium | 6.5 | 2025-05-21 | AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability. |
CVE-2025-27804 | Medium | 6.5 | 2025-05-21 | Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a cer… |
CVE-2025-44882 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafte… |
CVE-2025-44880 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-41225 | High | 8.8 | 2025-05-20 | The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script actio… |
CVE-2024-6486 | High | 7.2 | 2025-05-15 | The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This… |
CVE-2025-32002 | Critical | 9.8 | 2025-05-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' f… |
CVE-2025-47782 | | 2025-05-14 | motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a co… | |
CVE-2025-24022 | High | 8.5 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's p… |
CVE-2025-43562 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje… |
CVE-2025-45858 | Critical | 9.8 | 2025-05-13 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function. |
CVE-2025-40582 | High | 7.8 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices… |
CVE-2025-26389 | Critical | 10.0 | 2025-05-13 | A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the in… |
CVE-2025-47203 | Medium | 4.5 | 2025-05-07 | dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used. |
CVE-2025-32821 | High | 7.2 | 2025-05-07 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to u… |
CVE-2025-20213 | Medium | 5.5 | 2025-05-07 | A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to overwrite arbitrary… |
CVE-2025-20194 | Medium | 5.4 | 2025-05-07 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an inje… |
CVE-2025-20193 | Medium | 6.5 | 2025-05-07 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an inje… |
CVE-2025-20186 | High | 8.8 | 2025-05-07 | A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote atta… |
CVE-2025-45491 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter. |
CVE-2025-45042 | Critical | 9.8 | 2025-05-05 | Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. |
CVE-2025-2605 | Critical | 9.9 | 2025-05-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This is… |
CVE-2024-6032 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affect… |
CVE-2025-24351 | High | 8.8 | 2025-04-30 | A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arb… |
CVE-2025-4032 | Medium | 5.0 | 2025-04-28 | A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function… |
CVE-2022-41871 | Medium | 6.0 | 2025-04-28 | SEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute arbitrary code in the context of the us… |
CVE-2025-46272 | Critical | 9.1 | 2025-04-24 | WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host s… |
CVE-2025-46271 | Critical | 9.1 | 2025-04-24 | UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data. |
CVE-2025-43858 | Critical | 9.2 | 2025-04-24 | YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe c… |
CVE-2025-1976 | Medium | 6.7 | 2025-04-24 | Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with… |
CVE-2025-2773 | High | 7.2 | 2025-04-23 | BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-28039 | Critical | 9.8 | 2025-04-22 | TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileNa… |
CVE-2025-28038 | Critical | 9.8 | 2025-04-22 | TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWl… |
CVE-2025-28036 | Critical | 9.8 | 2025-04-22 | TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeU… |
CVE-2025-28035 | Critical | 9.8 | 2025-04-22 | TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUr… |
CVE-2025-28037 | Critical | 9.8 | 2025-04-22 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDia… |