CWE-88 · Argument Injection (page 3)
Page 3 of 5 — CVEs classified under CWE-88, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53509 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated at… |
CVE-2025-52459 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacke… |
CVE-2025-53542 | High | 7.7 | 2025-07-10 | Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of… |
CVE-2025-46835 | High | 8.5 | 2025-07-10 | Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file loca… |
CVE-2025-48385 | | 2025-07-08 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… | |
CVE-2025-49520 | High | 8.8 | 2025-06-30 | A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerab… |
CVE-2025-52480 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-3460 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Ne… |
CVE-2025-3459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper… |
CVE-2025-35010 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM comman… |
CVE-2025-35009 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command… |
CVE-2025-35008 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command… |
CVE-2025-35007 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command… |
CVE-2025-35006 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD comma… |
CVE-2025-35005 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command t… |
CVE-2025-35004 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command th… |
CVE-2025-32459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is… |
CVE-2025-32458 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32457 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32456 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. Th… |
CVE-2025-32455 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an… |
CVE-2025-49008 | | 2025-06-05 | Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/code… | |
CVE-2025-3945 | High | 7.2 | 2025-05-22 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterpris… |
CVE-2025-1712 | High | 8.8 | 2025-05-21 | Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files |
CVE-2025-31499 | High | 8.8 | 2025-04-15 | Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly… |
CVE-2025-32931 | Critical | 9.1 | 2025-04-14 | DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php a… |
CVE-2024-47516 | Critical | 9.8 | 2025-03-26 | A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure insta… |
CVE-2025-29768 | Medium | 4.4 | 2025-03-13 | Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because… |
CVE-2025-27146 | Low | 2.7 | 2025-02-25 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbit… |
CVE-2025-24845 | Medium | 5.5 | 2025-02-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If a… |
CVE-2025-0065 | High | 7.8 | 2025-01-28 | Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker… |
CVE-2022-31749 | Medium | 6.5 | 2025-01-28 | An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticate… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2024-9131 | High | 7.2 | 2025-01-10 | A user with administrator privileges can perform command injection |
CVE-2025-21613 | Critical | 9.8 | 2025-01-06 | go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5… |
CVE-2024-51532 | High | 7.1 | 2024-12-19 | Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with lo… |
CVE-2024-11633 | Critical | 9.1 | 2024-12-10 | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code executi… |
CVE-2021-1484 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected s… |
CVE-2024-39712 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-39711 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticate… |
CVE-2024-39710 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-38656 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated… |
CVE-2024-38655 | High | 7.2 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote… |
CVE-2024-52301 | High | 7.5 | 2024-11-12 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, th… |
CVE-2024-47553 | Critical | 9.9 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ``… |
CVE-2024-21533 | Medium | 6.5 | 2024-10-08 | All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the fi… |
CVE-2024-20444 | Medium | 5.5 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote atta… |
CVE-2024-47611 | | 2024-10-02 | XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools… | |
CVE-2024-43402 | High | 8.1 | 2024-09-04 | Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, w… |
CVE-2024-7573 | Medium | 5.3 | 2024-08-28 | The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient… |
CVE-2024-41711 | Medium | 6.8 | 2024-08-13 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a… |
CVE-2024-41710 | High | 7.2 | 2024-08-12 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a… |
CVE-2024-39933 | High | 7.7 | 2024-07-04 | Gogs through 0.13.0 allows argument injection during the tagging of a new release. |
CVE-2024-39930 | Critical | 9.9 | 2024-07-04 | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can… |
CVE-2024-35307 | Critical | 9.8 | 2024-06-10 | Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. Th… |
CVE-2024-2422 | High | 8.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows… |
CVE-2023-50232 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-44452 | High | 7.8 | 2024-05-03 | Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2024-31966 | Medium | 6.2 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-32884 | Medium | 6.4 | 2024-04-26 | gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpr… |
CVE-2024-3684 | High | 8.0 | 2024-04-19 | A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console t… |
CVE-2024-32462 | High | 8.4 | 2024-04-18 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a m… |
CVE-2024-3817 | Critical | 9.8 | 2024-04-17 | HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-g… |
CVE-2024-3367 | Medium | 6.5 | 2024-04-16 | Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p26 and <2.3.0b5 allows local attacker to inject one argument to runmqsc |
CVE-2024-3775 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitr… |
CVE-2024-24576 | Critical | 10.0 | 2024-04-09 | Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape argum… |
CVE-2024-22182 | High | 8.6 | 2024-03-01 | A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interruptin… |
CVE-2024-23731 | Critical | 9.8 | 2024-01-21 | The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument. |
CVE-2024-20287 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an aut… |
CVE-2023-20260 | Medium | 6.0 | 2024-01-17 | A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacke… |
CVE-2023-6634 | High | 8.1 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due… |
CVE-2023-47804 | High | 8.8 | 2023-12-29 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2023-46681 | High | 7.8 | 2023-12-26 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authentic… |
CVE-2023-6792 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and po… |
CVE-2023-49096 | High | 7.7 | 2023-12-06 | Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifi… |
CVE-2023-6269 | Critical | 10.0 | 2023-12-05 | An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (… |
CVE-2023-0633 | High | 7.2 | 2023-09-25 | In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop… |
CVE-2023-26143 | Medium | 6.5 | 2023-09-19 | Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user in… |
CVE-2023-39288 | Medium | 5.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated priv… |
CVE-2023-39287 | Medium | 5.5 | 2023-08-25 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated priv… |
CVE-2023-20224 | High | 7.8 | 2023-08-16 | A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate… |
CVE-2023-26310 | High | 7.4 | 2023-08-09 | There is a command injection problem in the old version of the mobile phone backup app. |
CVE-2023-33378 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute ar… |
CVE-2023-33376 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to exec… |
CVE-2023-30577 | High | 7.8 | 2023-07-26 | AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than… |
CVE-2023-34395 | High | 7.8 | 2023-06-27 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In… |
CVE-2022-37705 | Medium | 6.7 | 2023-04-16 | A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program… |
CVE-2023-25356 | High | 8.8 | 2023-04-04 | CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrar… |
CVE-2022-47502 | High | 7.8 | 2023-03-24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2022-40677 | High | 7.2 | 2023-02-16 | A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9… |
CVE-2022-4864 | Medium | 5.4 | 2022-12-30 | Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-46883 | High | 8.8 | 2022-12-22 | Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of t… |
CVE-2022-47926 | Critical | 9.8 | 2022-12-22 | AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php |
CVE-2022-44731 | Medium | 5.4 | 2022-12-13 | A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA… |
CVE-2022-23740 | High | 8.8 | 2022-11-23 | CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code exec… |
CVE-2022-45062 | Critical | 9.8 | 2022-11-09 | In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper. |
CVE-2021-46850 | High | 7.2 | 2022-10-24 | myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrativ… |
CVE-2022-42968 | Critical | 9.8 | 2022-10-16 | Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled. |
CVE-2022-3140 | Medium | 6.3 | 2022-10-11 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |
CVE-2022-20930 | Medium | 6.7 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system… |