CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Hva svakheten betyr

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Definisjonen gjengis slik MITRE har publisert den, på engelsk.

2 021 sårbarheter i tjenesten peker på denne svakheten

1. CVE-2024-3400 Utnyttes aktivt Kritisk 10.0

   Palo Alto Networks PAN-OS Command Injection Vulnerability

   A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configura…

2. CVE-2026-8037 Utnyttes aktivt Kritisk 9.8

   Progress LoadMaster Command Injection Vulnerability

   OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting un…

3. CVE-2025-10035 Utnyttes aktivt Kritisk 9.8

   Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

   A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object,…

4. CVE-2024-12987 Utnyttes aktivt Kritisk 9.8

   DrayTek Vigor Routers OS Command Injection Vulnerability

   A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the comp…

5. CVE-2024-12356 Utnyttes aktivt Kritisk 9.8

   BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

   A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site u…

6. CVE-2024-55956 Utnyttes aktivt Kritisk 9.8

   Cleo Multiple Products Unauthenticated File Upload Vulnerability

   In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leve…

7. CVE-2024-3273 Utnyttes aktivt Kritisk 9.8

   D-Link Multiple NAS Devices Command Injection Vulnerability

   ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the …

8. CVE-2023-20887 Utnyttes aktivt Kritisk 9.8

   Vmware Aria Operations for Networks Command Injection Vulnerability

   Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack…

9. CVE-2023-2868 Utnyttes aktivt Kritisk 9.8

   Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

   A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a …

10. CVE-2023-1671 Utnyttes aktivt Kritisk 9.8

    Sophos Web Appliance Command Injection Vulnerability

    A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

11. CVE-2016-20017 Utnyttes aktivt Kritisk 9.8

    D-Link DSL-2750B Devices Command Injection Vulnerability

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

12. CVE-2021-1498 Utnyttes aktivt Kritisk 9.8

    Cisco HyperFlex HX Data Platform Command Injection Vulnerability

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. F…

13. CVE-2020-2509 Utnyttes aktivt Kritisk 9.8

    QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have …

14. CVE-2018-19949 Utnyttes aktivt Kritisk 9.8

    QNAP NAS File Station Command Injection Vulnerability

    If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 2020…

15. CVE-2010-5330 Utnyttes aktivt Kritisk 9.8

    Ubiquiti AirOS Command Injection Vulnerability

    On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fi…

16. CVE-2016-1555 Utnyttes aktivt Kritisk 9.8

    NETGEAR Multiple WAP Devices Command Injection Vulnerability

    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and W…

17. CVE-2016-10033 Utnyttes aktivt Kritisk 9.8

    PHPMailer Command Injection Vulnerability

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (ba…

18. CVE-2007-3010 Utnyttes aktivt Kritisk 9.8

    Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

    masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the use…

19. CVE-2005-2773 Utnyttes aktivt Kritisk 9.8

    HP OpenView Network Node Manager Remote Code Execution Vulnerability

    HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3…

20. CVE-2024-21887 Utnyttes aktivt Kritisk 9.1

    Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests …

21. CVE-2026-42271 Utnyttes aktivt Høy 8.8

    BerriAI LiteLLM Command Injection Vulnerability

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST…

22. CVE-2025-4008 Utnyttes aktivt Høy 8.8

    Smartbedded Meteobridge Command Injection Vulnerability

    The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts…

23. CVE-2023-33538 Utnyttes aktivt Høy 8.8

    TP-Link Multiple Routers Command Injection Vulnerability

    TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

24. CVE-2023-1389 Utnyttes aktivt Høy 8.8

    TP-Link Archer AX-21 Command Injection Vulnerability

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web manage…

25. CVE-2021-22899 Utnyttes aktivt Høy 8.8

    Ivanti Pulse Connect Secure Command Injection Vulnerability

    A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature