CWE-77— Command Injection

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.— MITRE CWE catalog

4,586 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-77page 14 of 92

CVE-2024-3271CRITICALCVSS 9.8EG 9.8
2024-04-16
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code genera…
CVE-2024-3566CRITICALCVSS 9.8EG 9.8
2024-04-10
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
CVE-2024-27981CRITICALCVSS 9.8EG 9.8
2024-04-04
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalat…
CVE-2024-29640CRITICALCVSS 9.8EG 9.8
2024-03-29
An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.
CVE-2024-28545CRITICALCVSS 9.8EG 9.8
2024-03-26
Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function.
CVE-2024-29864CRITICALCVSS 9.8EG 9.8
2024-03-21
Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
CVE-2024-28125CRITICALCVSS 9.8EG 9.8
2024-03-18
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further inv…
CVE-2023-49959CRITICALCVSS 9.8EG 9.8
2024-02-26
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename paramete…
CVE-2024-25850CRITICALCVSS 9.8EG 9.8
2024-02-22
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
CVE-2023-24331CRITICALCVSS 9.8EG 9.8
2024-02-21
Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd parameter.
CVE-2024-24377CRITICALCVSS 9.8EG 9.8
2024-02-16
An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script.
CVE-2023-46687CRITICALCVSS 9.8EG 9.8
2024-02-09
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.
CVE-2024-24321CRITICALCVSS 9.8EG 9.8
2024-02-08
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
CVE-2024-24216CRITICALCVSS 9.8EG 9.8
2024-02-08
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
CVE-2024-23049CRITICALCVSS 9.8EG 9.8
2024-02-05
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
CVE-2024-23745CRITICALCVSS 9.8EG 9.8
2024-01-31
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit…
CVE-2023-7227CRITICALCVSS 9.8EG 9.8
2024-01-25
SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privile…
CVE-2024-22529CRITICALCVSS 9.8EG 9.8
2024-01-25
TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bin/boa.
CVE-2024-22729CRITICALCVSS 9.8EG 9.8
2024-01-25
NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
CVE-2023-52040CRITICALCVSS 9.8EG 9.8
2024-01-24
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
CVE-2023-52039CRITICALCVSS 9.8EG 9.8
2024-01-24
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
CVE-2023-52038CRITICALCVSS 9.8EG 9.8
2024-01-24
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
CVE-2023-51887CRITICALCVSS 9.8EG 9.8
2024-01-24
Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL.
CVE-2024-22651CRITICALCVSS 9.8EG 9.8
2024-01-24
There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
CVE-2024-22663CRITICALCVSS 9.8EG 9.8
2024-01-23
TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg
CVE-2023-52042CRITICALCVSS 9.8EG 9.8
2024-01-16
An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.
CVE-2023-52027CRITICALCVSS 9.8EG 9.8
2024-01-11
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function.
CVE-2023-51126CRITICALCVSS 9.8EG 9.8
2024-01-10
Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023)…
CVE-2023-51972CRITICALCVSS 9.8EG 9.8
2024-01-10
Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.
CVE-2023-31446CRITICALCVSS 9.8EG 9.8
2024-01-10
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
CVE-2023-49237CRITICALCVSS 9.8EG 9.8
2024-01-09
An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings.
CVE-2023-51812CRITICALCVSS 9.8EG 9.8
2024-01-04
Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList.
CVE-2023-51664CRITICALCVSS 9.8EG 9.8
2023-12-27
tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code a…
CVE-2023-51016CRITICALCVSS 9.8EG 9.8
2023-12-22
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.
CVE-2023-51014CRITICALCVSS 9.8EG 9.8
2023-12-22
TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of the cstecgi .cgi
CVE-2023-51025CRITICALCVSS 9.8EG 9.8
2023-12-22
TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interface of the cstecgi .cgi.
CVE-2023-51707CRITICALCVSS 9.8EG 9.8
2023-12-22
MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.
CVE-2023-50989CRITICALCVSS 9.8EG 9.8
2023-12-20
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function.
CVE-2023-50983CRITICALCVSS 9.8EG 9.8
2023-12-20
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
CVE-2023-6848CRITICALCVSS 9.8EG 9.8
2023-12-16
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of t…
CVE-2023-50917CRITICALCVSS 9.8EG 9.8
2023-12-15
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
CVE-2023-50089CRITICALCVSS 9.8EG 9.8
2023-12-15
A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the process after successful authentication.
CVE-2013-2513CRITICALCVSS 9.8EG 9.8
2023-12-12
The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file.
CVE-2023-40301CRITICALCVSS 9.8EG 9.8
2023-12-07
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
CVE-2023-49436CRITICALCVSS 9.8EG 9.8
2023-12-07
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
CVE-2023-49435CRITICALCVSS 9.8EG 9.8
2023-12-07
Tenda AX9 V22.03.01.46 is vulnerable to command injection.
CVE-2023-49431CRITICALCVSS 9.8EG 9.8
2023-12-07
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
CVE-2023-49437CRITICALCVSS 9.8EG 9.8
2023-12-07
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
CVE-2023-49428CRITICALCVSS 9.8EG 9.8
2023-12-07
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
CVE-2023-48801CRITICALCVSS 9.8EG 9.8
2023-12-01
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command exec…

Map vulnerabilities like CWE-77 to your infrastructure

EchelonGraph correlates every CVE — across CWE-77 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →