CWE-78 · OS Command Injection (page 27)
Page 27 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30289 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje… |
CVE-2025-30286 | High | 8.4 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje… |
CVE-2025-27079 | Medium | 6.0 | 2025-04-08 | A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perfo… |
CVE-2025-27078 | Medium | 6.5 | 2025-04-08 | A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating… |
CVE-2024-54025 | Medium | 6.7 | 2025-04-08 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator CLI before versi… |
CVE-2024-54024 | High | 7.2 | 2025-04-08 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2… |
CVE-2024-41790 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region para… |
CVE-2024-41789 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language pa… |
CVE-2024-41788 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input param… |
CVE-2025-3363 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3362 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3361 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2021-47667 | Critical | 10.0 | 2025-04-05 | An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbit… |
CVE-2025-3189 | | 2025-04-04 | Stored Cross-Site Scripting (XSS) in DoWISP in versions prior to 1.16.2.50, which consists of an stored XSS through the upload of a profile picture in SVG form… | |
CVE-2025-30370 | High | 7.4 | 2025-04-03 | jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes… |
CVE-2025-26817 | Critical | 9.8 | 2025-04-03 | Netwrix Password Secure 9.2.0.32454 allows OS command injection. |
CVE-2025-0676 | | 2025-04-02 | This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input… | |
CVE-2025-0415 | | 2025-04-02 | A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Succe… | |
CVE-2025-26055 | Medium | 6.5 | 2025-04-01 | An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter of the Tracert funct… |
CVE-2025-31693 | Medium | 6.6 | 2025-03-31 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Comma… |
CVE-2025-31692 | High | 7.5 | 2025-03-31 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Comma… |
CVE-2025-30004 | High | 8.8 | 2025-03-31 | Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands a… |
CVE-2025-3002 | High | 7.3 | 2025-03-31 | A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the f… |
CVE-2025-3022 | | 2025-03-31 | Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘clie… | |
CVE-2025-2071 | | 2025-03-31 | A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating… | |
CVE-2025-2983 | Medium | 5.5 | 2025-03-31 | A vulnerability has been found in Legrand SMS PowerView 1.x and classified as critical. Affected by this vulnerability is an unknown functionality. The manipul… |
CVE-2025-25579 | Critical | 9.8 | 2025-03-28 | TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. |
CVE-2025-28256 | Critical | 9.8 | 2025-03-28 | An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wire… |
CVE-2025-28219 | Critical | 9.8 | 2025-03-28 | Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via paramete… |
CVE-2025-24386 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24385 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24380 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24379 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24378 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24377 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-23383 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49601 | High | 7.3 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24383 | Critical | 9.1 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24382 | High | 7.3 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-22398 | Critical | 9.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49565 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49564 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49563 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-28138 | Critical | 9.8 | 2025-03-27 | The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the Not… |
CVE-2025-2257 | High | 7.2 | 2025-03-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2025-2733 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execu… |
CVE-2025-2717 | Medium | 4.7 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /gof… |
CVE-2025-0255 | High | 7.2 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted… |
CVE-2025-2701 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in AMTT Hotel Broadband Operation System 1.0. This vulnerability affects the function popen of the file /manag… |
CVE-2024-9053 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls t… |
CVE-2024-10019 | Medium | 6.7 | 2025-03-20 | A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function d… |
CVE-2025-25220 | High | 8.8 | 2025-03-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vul… |
CVE-2025-24306 | High | 7.2 | 2025-03-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.0_1101. If this vul… |
CVE-2025-2367 | Medium | 6.3 | 2025-03-17 | A vulnerability has been found in Oiwtech OIW-2431APGN-HP 2.5.3-B20131128 and classified as critical. This vulnerability affects unknown code of the file /boaf… |
CVE-2025-30076 | High | 7.7 | 2025-03-16 | Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. |
CVE-2025-20138 | High | 8.8 | 2025-03-12 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operat… |
CVE-2024-55590 | High | 8.8 | 2025-03-11 | Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiIsolator version… |
CVE-2024-54018 | High | 7.2 | 2025-03-11 | Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker t… |
CVE-2024-52961 | High | 8.8 | 2025-03-11 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 th… |
CVE-2024-32123 | Medium | 6.7 | 2025-03-11 | Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 thro… |
CVE-2025-22368 | | 2025-03-11 | The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are… | |
CVE-2025-22367 | | 2025-03-11 | The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command ar… | |
CVE-2025-22366 | | 2025-03-11 | The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command… | |
CVE-2025-27398 | Low | 2.7 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly neutralize special charact… |
CVE-2025-27394 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when c… |
CVE-2025-27393 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when c… |
CVE-2025-27392 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when c… |
CVE-2024-12010 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier co… |
CVE-2024-12009 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow… |
CVE-2024-11253 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(… |
CVE-2025-2096 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the fi… |
CVE-2025-2095 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cste… |
CVE-2025-2094 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConf… |
CVE-2024-53700 | High | 7.2 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gained administrator… |
CVE-2024-53692 | Medium | 4.7 | 2025-03-07 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50390 | Critical | 9.8 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands… |
CVE-2024-13892 | | 2025-03-06 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. Durin… | |
CVE-2025-1316 | Critical | 9.8 | 2025-03-05 | Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device |
CVE-2025-26320 | Medium | 6.5 | 2025-03-04 | t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping. |
CVE-2025-1829 | Medium | 6.3 | 2025-03-02 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the… |
CVE-2025-1819 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. T… |
CVE-2025-20161 | Medium | 5.1 | 2025-02-26 | A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow a… |
CVE-2025-1676 | Medium | 6.3 | 2025-02-25 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the… |
CVE-2025-27140 | Critical | 9.8 | 2025-02-24 | WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application… |
CVE-2025-27364 | Critical | 10.0 | 2025-02-24 | In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation funct… |
CVE-2025-22495 | High | 8.4 | 2025-02-24 | An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated h… |
CVE-2025-1616 | Medium | 4.7 | 2025-02-24 | A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality… |
CVE-2025-1610 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_… |
CVE-2025-1609 | Medium | 6.3 | 2025-02-24 | A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file… |
CVE-2025-1608 | Medium | 6.3 | 2025-02-24 | A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd… |
CVE-2025-27106 | High | 8.8 | 2025-02-21 | binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Exe… |
CVE-2025-1546 | High | 7.3 | 2025-02-21 | A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is th… |
CVE-2025-1536 | High | 7.3 | 2025-02-21 | A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2025-1265 | Critical | 9.9 | 2025-02-20 | An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affec… |
CVE-2025-26856 | High | 7.2 | 2025-02-20 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an a… |
CVE-2025-25895 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arb… |
CVE-2025-25894 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to… |
CVE-2025-25893 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This v… |
CVE-2025-26613 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeG… |
CVE-2021-46686 | Critical | 9.8 | 2025-02-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB v… |