İçeriğe atla
Noroxi

CWE-77 · 3.349 kayıt

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Bu sınıftaki CVE’ler

3.349 kayıt

  • CVE-2023-1671
    99Hemen

    A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    sophos · web appliance4 Nis 2023

  • CVE-2012-1823
    99Hemen

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle que

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    php · php11 May 2012

  • CVE-2024-3273
    99Hemen

    D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    dlink · dns-320l firmware3 Nis 2024

  • CVE-2025-10035
    99Hemen

    Deserialization Vulnerability in GoAnywhere MFT's License Servlet

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    fortra · goanywhere managed file transfer18 Eyl 2025

  • CVE-2026-8037
    99Hemen

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    progress · connection manager for objectscale4 Haz 2026

  • CVE-2016-1555
    98Hemen

    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    netgear · wnap320 firmware21 Nis 2017

  • CVE-2023-20887
    98Hemen

    Aria Operations for Networks contains a command injection vulnerability.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    vmware · aria operations for networks7 Haz 2023

  • CVE-2007-3010
    98Hemen

    masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to exe

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    al-enterprise · omnipcx enterprise communication server18 Eyl 2007

  • CVE-2024-55956
    97Hemen

    In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    cleo · harmony13 Ara 2024

  • CVE-2024-21887
    96Hemen

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an aut

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %99

    ivanti · connect secure12 Oca 2024

  • CVE-2023-1389
    95Hemen

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form o

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    tp-link · archer ax21 firmware15 Mar 2023

  • CVE-2024-12356
    95Hemen

    Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87

    beyondtrust · privileged remote access17 Ara 2024

  • CVE-2026-105134
    95Hemen

    Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %81

    ahsay · cloud backup suite4 Eki 2026

  • CVE-2015-2051
    94Hemen

    The D-Link DIR-645 Wired/Wireless Router Rev.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %97

    dlink · dir-645 firmware23 Şub 2015

  • CVE-2025-4008
    92Hemen

    Arbitrary Command Injection in Smartbedded MeteoBridge

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %93

    smartbedded · meteobridge vm21 May 2025

  • CVE-2016-3081
    91Hemen

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %96

    apache · struts26 Nis 2016

  • CVE-2026-42271
    91Hemen

    LiteLLM: Authenticated command execution via MCP stdio test endpoints

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %91

    litellm · litellm8 May 2026

  • CVE-2005-2773
    91Hemen

    HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1)

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %74

    hp · openview network node manager2 Eyl 2005

  • CVE-2016-20017
    89Hemen

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %65

    dlink · dsl-2750b firmware19 Eki 2022

  • CVE-2024-12987
    86Hemen

    DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection

    OrtaCVSS 6,9KEVSilahlaştırılmışEPSS %98

    draytek · vigor300b firmware27 Ara 2024

  • CVE-2025-29635
    84Hemen

    A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %87

    dlink · dir-823x firmware25 Mar 2025

  • CVE-2020-25079
    81Hemen

    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %54

    dlink · dcs-4703e firmware2 Eyl 2020

  • CVE-2019-0541
    81Hemen

    A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Ex

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %53

    microsoft · internet explorer8 Oca 2019

  • CVE-2010-5330
    81Hemen

    On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %40

    ui · airos11 Haz 2019

  • CVE-2020-2509
    79Bu hafta

    Command Injection Vulnerability in QTS and QuTS hero

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %33

    qnap · qts17 Nis 2021

Tüm zafiyet sınıfları