CWE-78 · OS Command Injection (page 23)
Page 23 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22495 | High | 8.4 | 2025-02-24 | An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated h… |
CVE-2025-1616 | Medium | 4.7 | 2025-02-24 | A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality… |
CVE-2025-1610 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_… |
CVE-2025-1609 | Medium | 6.3 | 2025-02-24 | A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file… |
CVE-2025-1608 | Medium | 6.3 | 2025-02-24 | A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd… |
CVE-2025-27106 | High | 8.8 | 2025-02-21 | binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Exe… |
CVE-2025-1546 | High | 7.3 | 2025-02-21 | A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is th… |
CVE-2025-1536 | High | 7.3 | 2025-02-21 | A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2025-1265 | Critical | 9.9 | 2025-02-20 | An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affec… |
CVE-2025-26856 | High | 7.2 | 2025-02-20 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an a… |
CVE-2025-25895 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arb… |
CVE-2025-25894 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to… |
CVE-2025-25893 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This v… |
CVE-2025-26613 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeG… |
CVE-2021-46686 | Critical | 9.8 | 2025-02-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB v… |
CVE-2025-1370 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf… |
CVE-2025-1369 | Medium | 4.5 | 2025-02-17 | A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-1339 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cg… |
CVE-2024-5461 | High | 8.0 | 2025-02-15 | Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to… |
CVE-2024-55904 | High | 7.2 | 2025-02-14 | IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 / IBM UrbanCode Deploy 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 thr… |
CVE-2025-25067 | Critical | 9.8 | 2025-02-13 | mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands. |
CVE-2025-1229 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unkn… |
CVE-2025-0110 | | 2025-02-12 | A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI reque… | |
CVE-2025-1244 | High | 8.8 | 2025-02-12 | A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnera… |
CVE-2024-50569 | Medium | 6.6 | 2025-02-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execut… |
CVE-2024-50567 | High | 7.2 | 2025-02-11 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execu… |
CVE-2024-40584 | High | 7.2 | 2025-02-11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 th… |
CVE-2024-47908 | Critical | 9.1 | 2025-02-11 | OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote… |
CVE-2024-8684 | High | 8.3 | 2025-02-10 | OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker… |
CVE-2025-24366 | High | 7.5 | 2025-02-07 | SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default command… |
CVE-2024-57357 | High | 8.0 | 2025-02-07 | An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_4256CC, which allows… |
CVE-2024-51450 | Critical | 9.1 | 2025-02-06 | IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2025-20029 | High | 8.8 | 2025-02-05 | Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitra… |
CVE-2024-56132 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2025-25039 | Medium | 4.7 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrar… |
CVE-2025-24971 | | 2025-02-04 | DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was disco… | |
CVE-2024-23690 | High | 7.2 | 2025-02-04 | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker… |
CVE-2024-40891 | High | 8.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmwar… |
CVE-2024-40890 | High | 8.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware versio… |
CVE-2024-53942 | Medium | 4.8 | 2025-02-03 | An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4… |
CVE-2024-53584 | Critical | 9.8 | 2025-01-31 | OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter. |
CVE-2025-0680 | Critical | 9.8 | 2025-01-30 | Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary dev… |
CVE-2025-20061 | Critical | 9.8 | 2025-01-29 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker t… |
CVE-2025-20014 | Critical | 9.8 | 2025-01-29 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker… |
CVE-2025-0798 | High | 8.1 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-24480 | | 2025-01-28 | A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a re… | |
CVE-2025-22604 | Critical | 9.1 | 2025-01-27 | Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OI… |
CVE-2024-57595 | Critical | 9.8 | 2025-01-27 | DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apc_client_pin.cgi, which allows remote attackers to execute ar… |
CVE-2025-22606 | High | 7.8 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, wh… |
CVE-2025-22605 | High | 7.8 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.2… |
CVE-2025-23237 | Medium | 6.6 | 2025-01-22 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If a us… |
CVE-2025-20617 | High | 7.2 | 2025-01-22 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an a… |
CVE-2023-37032 | High | 7.5 | 2025-01-21 | A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486)… |
CVE-2024-57542 | High | 8.8 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn. |
CVE-2025-0528 | High | 7.2 | 2025-01-17 | A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality… |
CVE-2024-13502 | | 2025-01-17 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux… | |
CVE-2025-0457 | High | 8.8 | 2025-01-16 | The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbit… |
CVE-2024-57025 | Medium | 6.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg. |
CVE-2024-57024 | Medium | 6.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg. |
CVE-2024-57023 | Medium | 6.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg. |
CVE-2024-57022 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg. |
CVE-2024-57021 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg. |
CVE-2024-57020 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg. |
CVE-2024-57019 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg. |
CVE-2024-57018 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg. |
CVE-2024-57017 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg. |
CVE-2024-57016 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg. |
CVE-2024-57015 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg. |
CVE-2024-57014 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg. |
CVE-2024-57013 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg. |
CVE-2024-57012 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg. |
CVE-2024-57011 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg. |
CVE-2025-0356 | High | 7.2 | 2025-01-15 | NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network. |
CVE-2024-56497 | Medium | 6.7 | 2025-01-14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 thro… |
CVE-2024-50566 | High | 7.2 | 2025-01-14 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1… |
CVE-2024-48890 | Medium | 6.6 | 2025-01-14 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7… |
CVE-2024-40587 | Medium | 6.7 | 2025-01-14 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiVoice version 7.0.0 throu… |
CVE-2024-27778 | High | 8.8 | 2025-01-14 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSa… |
CVE-2024-26012 | Medium | 6.7 | 2025-01-14 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, F… |
CVE-2023-37937 | High | 7.8 | 2025-01-14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and… |
CVE-2025-20055 | Critical | 9.8 | 2025-01-14 | OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected… |
CVE-2025-20016 | High | 7.2 | 2025-01-14 | OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privi… |
CVE-2025-0107 | Critical | 9.8 | 2025-01-11 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in… |
CVE-2024-12847 | Critical | 9.8 | 2025-01-10 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating… |
CVE-2024-57687 | Critical | 9.8 | 2025-01-10 | An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to e… |
CVE-2024-43657 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43656 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43655 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… | |
CVE-2024-43654 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Inject… |
CVE-2024-43653 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43652 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… |
CVE-2024-43651 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… | |
CVE-2024-43650 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injecti… | |
CVE-2024-43649 | High | 8.8 | 2025-01-09 | Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firm… |
CVE-2024-43648 | High | 8.8 | 2025-01-09 | Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmwa… |
CVE-2024-50603 | Critical | 10.0 | 2025-01-08 | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS… |
CVE-2024-11681 | Medium | 6.8 | 2025-01-07 | A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror. |
CVE-2024-12970 | Low | 3.9 | 2025-01-06 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Computer allows OS Comm… |
CVE-2024-13129 | High | 8.8 | 2025-01-03 | A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file a… |
CVE-2024-9140 | Critical | 9.8 | 2025-01-03 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS… |