VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (6,835)

page 87 of 342
  • CVE-2017-16921HigDec 8, 2017
    OTRS
    Otrs
    risk 0.62cvss 8.8epss 0.20

    In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of…

  • CVE-2017-17055CriDec 7, 2017
    Artica
    Web Proxy
    risk 0.62cvss 9.0epss 0.09

    Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php.

  • CVE-2015-5958HigAug 31, 2017
    Phpfilemanager Project
    Phpfilemanager
    risk 0.62cvss 8.8epss 0.27

    phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.

  • CVE-2015-2280HigJul 25, 2017
    Airlink101
    SkyIPCam1620W
    risk 0.62cvss 8.8epss 0.17

    snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter.

  • CVE-2026-58146CriSep 16, 2026
    WNC
    T-Mobile 5G Box IDU router
    risk 0.61cvss —epss 0.02

    WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command…

  • CVE-2026-89308CriSep 15, 2026
    Trexom
    trexom-aggiornamenti-di-sicurezza
    risk 0.61cvss —epss 0.03

    An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.

  • CVE-2026-76156CriAug 21, 2026
    Datiphy
    Data Management Center
    risk 0.61cvss —epss 0.01

    OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.

  • CVE-2026-46399CriJun 5, 2026
    Haxtheweb
    HAX CMS PHP
    risk 0.61cvss —epss 0.00

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code…

  • CVE-2026-45087CriMay 27, 2026
    Hahwul
    Dalfox
    risk 0.61cvss 10.0epss 0.13

    Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key.…

  • CVE-2026-41926CriMay 4, 2026
    risk 0.61cvss —epss 0.01

    WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters…

  • CVE-2026-41925CriMay 4, 2026
    risk 0.61cvss —epss 0.03

    WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the reboot_time…

  • CVE-2026-41924CriMay 4, 2026
    Yeapook
    Wdr201a Wifi Extender
    risk 0.61cvss —epss 0.03

    WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the set_time or StartSniffer…

  • CVE-2026-41923CriMay 4, 2026
    risk 0.61cvss —epss 0.03

    WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter.…

  • CVE-2026-41922CriMay 4, 2026
    risk 0.61cvss —epss 0.05

    WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the wireless.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the sz11gChannel or PIN POST…

  • CVE-2026-4631CriApr 7, 2026
    risk 0.61cvss 9.8epss 0.15

    Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects…

  • CVE-2025-30044CriMar 2, 2026
    CGM
    CLININET
    risk 0.61cvss —epss 0.01

    In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code…

  • CVE-2025-65008CriDec 18, 2025
    WODESYS
    WD-R608U
    risk 0.61cvss —epss 0.03

    In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands. The vendor was notified early about this vulnerability, but didn't respond…

  • CVE-2023-53872CriDec 15, 2025
    Metinyesil
    Wp2fac
    risk 0.61cvss —epss 0.01

    Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute…

  • CVE-2020-36877CriDec 5, 2025
    Request It
    Request It
    risk 0.61cvss —epss 0.01

    ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote…

  • CVE-2025-34319CriDec 3, 2025
    Totolink
    CX-N300RT
    risk 0.61cvss —epss 0.04

    TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger…