VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (6,475)

page 3 of 324
  • CVE-2022-26258CriKEVMar 28, 2022
    Dlink
    Dir 820l Firmware
    risk 0.82cvss 9.8epss 0.80

    D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

  • CVE-2021-27561CriKEVOct 15, 2021
    Yealink
    Device Management
    risk 0.82cvss 9.8epss 0.83

    Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

  • CVE-2020-10987CriKEVJul 13, 2020
    Tenda
    AC15 AC1900
    risk 0.82cvss 9.8epss 0.80

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

  • CVE-2020-15415CriKEVJun 30, 2020
    Draytek
    Vigor3900
    risk 0.82cvss 9.8epss 0.85

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

  • CVE-2025-1316CriKEVMar 5, 2025
    Edimax
    IC-7100
    risk 0.81cvss 9.8epss 0.73

    Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device

  • CVE-2017-6884HigKEVApr 6, 2017
    Zyxel
    EMG2926
    risk 0.81cvss 8.8epss 0.38

    A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands…

  • CVE-2026-34197HigKEVApr 7, 2026
    Apache
    Activemq
    risk 0.80cvss 8.8epss 0.97

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy…

  • CVE-2022-36804HigKEVAug 25, 2022
    Atlassian
    Bitbucket Server
    risk 0.80cvss 8.8epss 0.99

    Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from…

  • CVE-2022-33891HigKEVJul 18, 2022
    Apache
    Spark
    risk 0.80cvss 8.8epss 0.93

    The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter…

  • CVE-2020-16846CriKEVNov 6, 2020
    Saltstack
    Salt
    risk 0.80cvss 9.8epss 1.00

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

  • CVE-2019-10149CriKEVJun 5, 2019
    Exim
    Exim
    risk 0.80cvss 9.8epss 1.00

    A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

  • CVE-2014-6278HigKEVSep 30, 2014
    GNU
    Bash
    risk 0.80cvss 8.8epss 1.00

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH…

  • CVE-2024-56145CriKEVDec 18, 2024
    Craftcms
    CMS
    risk 0.79cvss 9.8epss 0.97

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code…

  • CVE-2020-4428CriKEVMay 7, 2020
    IBM
    Data Risk Manager
    risk 0.79cvss 9.1epss 0.62

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.

  • CVE-2026-25089CriKEVJun 9, 2026
    Fortinet
    Fortisandbox
    risk 0.78cvss 9.8epss 0.74

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS…

  • CVE-2025-48703CriKEVSep 19, 2025
    Centos Web Panel
    Centos Web Panel
    risk 0.78cvss 9.0epss 1.00

    CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

  • CVE-2024-11120CriKEVNov 15, 2024
    Geovision
    GeoVision devices
    risk 0.78cvss 9.8epss 0.29

    Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we…

  • CVE-2024-45519CriKEVOct 2, 2024
    Zimbra
    Zimbra Collaboration (ZCS)
    risk 0.78cvss 10.0epss 1.00

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

  • CVE-2022-20708CriKEVFeb 10, 2022
    Cisco Systems, Inc.
    Small Business RV160
    risk 0.78cvss 10.0epss 0.15

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and…

  • CVE-2020-2509CriKEVApr 17, 2021
    QTS
    QTS
    risk 0.78cvss 9.8epss 0.33

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build…