CVE Daily
← All tags

Tag: Command Injection

All CVEs associated with "Command Injection". Page 1/3 • 272 CVEs.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0
2025-08-18
Critical

CVE-2025-55591

TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.

CVSS: 9.8 CWE: CWE-77
Read more
Medium

CVE-2025-55590

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html.

CVSS: 6.5 CWE: CWE-77
Read more
Medium

CVE-2025-55589

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters at /boafrm/formMapDelDevice.

CVSS: 6.5 CWE: CWE-78
Read more
Critical

CVE-2025-31715

In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.

CVSS: 9.8 CWE: N/A
Read more
High

CVE-2025-31713

In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.

CVSS: 8.4 CWE: N/A
Read more
2025-08-17
Medium

CVE-2025-9090

A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injecti…

CVSS: 6.3 CWE: CWE-74
Read more
2025-08-15
High

CVE-2025-9026

A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads…

CVSS: 7.3 CWE: CWE-77
Read more
2025-08-14
High

CVE-2025-8876

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

CVSS: 8.8 CWE: CWE-20
Read more
High

CVE-2024-53946

The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user int…

CVSS: 8.8 CWE: CWE-352
Read more
High

CVE-2024-53945

The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS com…

CVSS: 8.8 CWE: CWE-77
Read more
Medium

CVE-2025-8956

A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. Th…

CVSS: 6.3 CWE: CWE-74
Read more
Medium

CVE-2025-8937

A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can b…

CVSS: 6.3 CWE: CWE-74
Read more
2025-08-13
Critical

CVE-2012-10059

Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat…

CVSS: 9.4 CWE: CWE-78
Read more
Medium

CVE-2025-50946

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

CVSS: 6.5 CWE: CWE-78
Read more
High

CVE-2025-54074

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP…

CVSS: 7.7 CWE: CWE-78
Read more
2025-08-12
High

CVE-2025-49813

An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authentica…

CVSS: 7.2 CWE: CWE-78
Read more
Medium

CVE-2025-47857

A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a priv…

CVSS: 6.7 CWE: CWE-78
Read more
Medium

CVE-2025-27759

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 throu…

CVSS: 6.7 CWE: CWE-78
Read more
Critical

CVE-2025-25256

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 thro…

CVSS: 9.8 CWE: CWE-78
Read more
High

CVE-2025-53773

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-77
Read more
2025-08-11
Critical

CVE-2012-10040

Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2012-10039

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitati…

CVSS: 9.4 CWE: CWE-78
Read more
Medium

CVE-2025-8830

A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of the file /goform/setWan. The manipulati…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8829

A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_red of the file /goform/RP_setBasicAuto.…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8828

A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /goform/setIpv6. The manipulation of the argum…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8827

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function um_inspect_cross_band of the file /goform/RP_setBasicAuto. The m…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8825

A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function RP_setBasicAuto of the file /goform/RP_setBasicAuto. The manipula…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8823

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setDeviceName of the file /goform/setDeviceName.…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8821

A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function RP_setBasic of the file /goform/RP_setBasic. The manipulati…

CVSS: 6.3 CWE: CWE-77
Read more
2025-08-10
Medium

CVE-2025-8818

A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSetting of the file /goform/setLan. The manipu…

CVSS: 6.3 CWE: CWE-77
Read more
2025-08-09
High

CVE-2025-8752

A vulnerability was found in wangzhixuan spring-shiro-training up to 94812c1fd8f7fe796c931f4984ff1aa0671ab562. It has been declared as critical. This vulnerability affects unknown code of the file /r…

CVSS: 7.3 CWE: CWE-74
Read more
2025-08-08
High

CVE-2012-10048

Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, a…

CVSS: 8.7 CWE: CWE-22
Read more
Critical

CVE-2012-10046

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize u…

CVSS: 9.3 CWE: CWE-78
Read more
Critical

CVE-2012-10041

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc POST parameter, allowing remote attackers…

CVSS: 9.3 CWE: CWE-78
Read more
High

CVE-2025-8748

MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user could allow the execution of arbitrary comma…

CVSS: 8.8 CWE: CWE-78
Read more
Medium

CVE-2025-54958

Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be executed on the affected product.

CVSS: 6.3 CWE: CWE-78
Read more
Medium

CVE-2024-58257

EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.

CVSS: 5.7 CWE: CWE-200
Read more
Medium

CVE-2024-58256

EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.

CVSS: 4.5 CWE: CWE-200
Read more
Medium

CVE-2024-58255

EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.

CVSS: 5.0 CWE: CWE-200
Read more
2025-08-07
Medium

CVE-2025-8697

A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPSessionManager/MCPTool/MCPToolkit. The ma…

CVSS: 6.3 CWE: CWE-77
Read more
Critical

CVE-2025-34152

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is p…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2025-34151

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2025-34150

The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter. Input is processed unsafely during netw…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2025-34149

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, ena…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2025-34148

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in WISP mode, the 'ssid' parameter is passed…

CVSS: 9.4 CWE: CWE-78
Read more
Medium

CVE-2025-47188

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit through 6.4 SP4, could allow an unauthenticated attacker to conduct a command in…

CVSS: 6.5 CWE: CWE-77
Read more
2025-08-06
High

CVE-2025-7769

Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handlin…

CVSS: 8.7 CWE: CWE-77
Read more
Medium

CVE-2025-8667

A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the function from_code/from_dict/from_mcp of th…

CVSS: 6.3 CWE: CWE-77
Read more
Medium

CVE-2025-8665

A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the library libs/agno/agno/tools/mcp.py of th…

CVSS: 6.3 CWE: CWE-77
Read more
High

CVE-2025-22469

OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. An arbitrary OS command may be executed on the system with a…

CVSS: 7.3 CWE: CWE-78
Read more
Medium

CVE-2025-8655

Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenw…

CVSS: 6.8 CWE: CWE-78
Read more
High

CVE-2025-8654

Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwoo…

CVSS: 8.8 CWE: CWE-78
Read more
Medium

CVE-2025-8652

Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Ken…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8651

Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Ken…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8650

Kenwood DMX958XR libSystemLib Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenw…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8649

Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Ken…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8648

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8647

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8646

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8645

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8644

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8643

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8642

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8641

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8640

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8639

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected Kenwood DMX958XR devices. Authentication…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8638

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8637

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8636

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8635

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8634

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8633

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8632

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8631

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8630

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8629

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
Medium

CVE-2025-8628

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR device…

CVSS: 6.8 CWE: CWE-78
Read more
2025-08-05
Critical

CVE-2013-10069

The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improp…

CVSS: 10.0 CWE: CWE-78
Read more
High

CVE-2012-10029

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized pa…

CVSS: 8.6 CWE: CWE-78
Read more
Medium

CVE-2025-50688

A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a sp…

CVSS: 6.5 CWE: CWE-77
Read more
High

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_pin and /ubus/?flag=netAppStar1 and /ubu…

CVSS: 7.4 CWE: CWE-78
Read more
2025-08-04
Critical

CVE-2025-27212

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Acc…

CVSS: 9.8 CWE: CWE-20
Read more
High

CVE-2025-27211

An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.

CVSS: 7.5 CWE: CWE-20
Read more
Critical

CVE-2025-51390

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.

CVSS: 9.8 CWE: CWE-78
Read more
Critical

CVE-2025-34147

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in Extender mode via its captive portal, the…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2025-44961

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

CVSS: 9.9 CWE: CWE-78
Read more
High

CVE-2025-44960

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.

CVSS: 8.5 CWE: CWE-78
Read more
High

CVE-2025-30099

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release ver…

CVSS: 7.8 CWE: CWE-78
Read more
Medium

CVE-2025-30098

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release ver…

CVSS: 6.7 CWE: CWE-78
Read more
Medium

CVE-2025-30097

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release ver…

CVSS: 6.7 CWE: CWE-78
Read more
Medium

CVE-2025-30096

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release ver…

CVSS: 6.7 CWE: CWE-78
Read more
High

CVE-2025-36607

Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the res…

CVSS: 7.8 CWE: CWE-78
Read more
High

CVE-2025-36606

Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nfssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping…

CVSS: 7.8 CWE: CWE-78
Read more
High

CVE-2025-36604

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote a…

CVSS: 7.3 CWE: CWE-78
Read more
2025-08-01
High

CVE-2013-10061

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi en…

CVSS: 8.6 CWE: CWE-78
Read more
Critical

CVE-2013-10060

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with va…

CVSS: 9.4 CWE: CWE-78
Read more
High

CVE-2013-10059

An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to san…

CVSS: 8.6 CWE: CWE-78
Read more
High

CVE-2013-10058

An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails…

CVSS: 8.6 CWE: CWE-78
Read more
High

CVE-2013-10050

An OS command injection vulnerability exists in multiple D-Link routers—confirmed on DIR-300 rev A (v1.05) and DIR-615 rev D (v4.13)—via the authenticated tools_vct.xgi CGI endpoint. The web interfac…

CVSS: 8.7 CWE: CWE-78
Read more
Critical

CVE-2013-10049

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the we…

CVSS: 9.3 CWE: CWE-78
Read more
Critical

CVE-2013-10048

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the u…

CVSS: 9.3 CWE: CWE-78
Read more
High

CVE-2025-8480

Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authenticat…

CVSS: 8.0 CWE: CWE-22
Read more
Medium

CVE-2025-8473

Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devic…

CVSS: 6.6 CWE: CWE-78
Read more
2025-07-31
Critical

CVE-2025-50475

An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands as root via crafted input to the hostnam…

CVSS: 9.8 CWE: CWE-78
Read more
High

CVE-2013-10039

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the…

CVSS: 8.7 CWE: CWE-78
Read more
Critical

CVE-2013-10037

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell comman…

CVSS: 9.3 CWE: CWE-78
Read more
2025-07-29
Medium

CVE-2025-52284

Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to…

CVSS: 6.5 CWE: CWE-77
Read more
2025-07-28
Critical

CVE-2025-54418

CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagic…

CVSS: 9.8 CWE: CWE-78
Read more
Critical

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.

CVSS: 9.4 CWE: CWE-78
Read more
High

CVE-2025-8259

A vulnerability, which was classified as critical, was found in Vaelsys 4.1.0. This affects the function execute_DataObjectProc of the file /grid/vgrid_server.php. The manipulation of the argument xa…

CVSS: 7.3 CWE: CWE-77
Read more
2025-07-27
Low

CVE-2024-58266

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

CVSS: 3.2 CWE: CWE-116
Read more
2025-07-25
Critical

CVE-2014-125118

A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php…

CVSS: 9.4 CWE: CWE-78
Read more
Critical

CVE-2019-25224

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arb…

CVSS: 9.8 CWE: CWE-78
Read more
2025-07-24
Medium

CVE-2025-7404

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web:…

CVSS: 5.9 CWE: CWE-78
Read more
Critical

CVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Cod…

CVSS: 10.0 CWE: CWE-78
Read more
2025-07-23
High

CVE-2025-54377

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypa…

CVSS: 7.8 CWE: CWE-77
Read more
Critical

CVE-2015-10141

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug…

CVSS: 9.3 CWE: CWE-78
Read more
High

CVE-2024-53286

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remo…

CVSS: 7.2 CWE: CWE-78
Read more
2025-07-22
Medium

CVE-2025-43020

A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. H…

CVSS: 5.7 CWE: CWE-78
Read more
High

CVE-2025-7724

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2:…

CVSS: 8.7 CWE: CWE-78
Read more