TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time.

CVE-2021-45738CRITICALCVSS 9.8EG 9.8

2022-02-04

TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.

CVE-2021-45742CRITICALCVSS 9.8EG 9.8

2022-02-04

TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

CVE-2021-45806HIGHCVSS 8.8EG 8.8

2022-01-13

jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.

CVE-2021-45807CRITICALCVSS 9.8EG 9.8

2022-01-13

jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.

CVE-2021-45876CRITICALCVSS 9.8EG 9.8

2022-03-21

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate co…

CVE-2021-45966CRITICALCVSS 9.8EG 9.8

2022-03-18

An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.

CVE-2021-45978HIGHCVSS 7.8EG 7.8

2022-01-04

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API.

CVE-2021-45979HIGHCVSS 7.8EG 7.8

2022-01-04

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript API.

CVE-2021-45986CRITICALCVSS 9.8EG 9.8

2022-02-04

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerability allows attackers to execute arbitrary commands via the usbOrdinaryUserName pa…

CVE-2021-45987CRITICALCVSS 9.8EG 9.8

2022-02-04

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerability allows attackers to execute arbitrary commands via the hostName parameter.

CVE-2021-45990CRITICALCVSS 9.8EG 9.8

2022-02-04

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability allows attackers to execute arbitrary commands via the pic_name parameter.

CVE-2021-45998CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST reque…

CVE-2021-46226CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter.

CVE-2021-46227CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows attackers to execute arbitrary commands via the proxy_srv, proxy_srvport, proxy…

CVE-2021-46228CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows attackers to execute arbitrary commands via the time parameter.

CVE-2021-46229CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter.

CVE-2021-46230CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows attackers to execute arbitrary commands via the path and time parameters.

CVE-2021-46231CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd_opt.asp. This vulnerability allows attackers to execute arbitrary commands via the url_en parameter.

CVE-2021-46232CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter.

CVE-2021-46233CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function msp_info.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter.

CVE-2021-46314CRITICALCVSS 9.8EG 9.8

2022-02-17

A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection w…

CVE-2021-46452CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomography_ping_add…

CVE-2021-46453CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. This vulnerability allows attackers to execute arbitrary commands via the staticroute_list paramete…

CVE-2021-46454CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability allows attackers to execute arbitrary commands via the ApCliKeyStr parameter.

CVE-2021-46455CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allows attackers to execute arbitrary commands via the station_access_enable paramet…

CVE-2021-46456CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl(0).(0)_maclist parameter.

CVE-2021-46457CRITICALCVSS 9.8EG 9.8

2022-02-04

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability allows attackers to execute arbitrary commands via the samba_name parameter.

CVE-2021-46560CRITICALCVSS 9.8EG 9.8

2022-01-26

The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.

CVE-2021-46850HIGHCVSS 7.2EG 7.2

2022-10-24

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when send…

CVE-2022-0902HIGHCVSS 8.1EG 9.8

2022-07-21

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-…

CVE-2022-0999HIGHCVSS 8.8EG 8.8

2022-04-11

An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior.

CVE-2022-1030HIGHCVSS 8.8EG 8.8

2022-03-23

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a…

CVE-2022-1509CRITICALCVSS 9.9EG 8.8

2022-04-28

Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.

CVE-2022-1884CRITICALCVSS 9.8EG 9.8

2024-11-15

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tr…

CVE-2022-20054HIGHCVSS 7.8EG 7.8

2022-03-10

In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. P…

CVE-2022-20345HIGHCVSS 8.8EG 8.8

2022-08-10

In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not…

CVE-2022-20665MEDIUMCVSS 6.0EG 6.7

2022-04-06

A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this…

CVE-2022-20799MEDIUMCVSS 4.7EG 7.2

2022-05-04

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an …

CVE-2022-20801MEDIUMCVSS 4.7EG 7.2

2022-05-04

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an …

CVE-2022-20851MEDIUMCVSS 5.5EG 7.2

2022-09-30

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker…

CVE-2022-20925MEDIUMCVSS 6.3EG 7.2

2022-11-15

A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability is…

CVE-2022-20926MEDIUMCVSS 6.3EG 8.8

2022-11-15

A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability is…

CVE-2022-20934MEDIUMCVSS 6.0EG 6.7

2022-11-15

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. This vulnerabilit…

CVE-2022-21129HIGHCVSS 7.4EG 7.4

2023-01-31

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to…

CVE-2022-21165CRITICALCVSS 9.8EG 9.8

2022-08-29

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.

CVE-2022-21191HIGHCVSS 7.4EG 7.4

2023-01-13

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

CVE-2022-2143CRITICALCVSS 9.8EG 9.8

2022-07-22

The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.

CVE-2022-21668HIGHCVSS 8.0EG 8.0

2022-01-10

pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere…

CVE-2022-21810HIGHCVSS 7.4EG 7.8

2023-01-26

All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.

CWE-77— Command Injection

CVEs classified under CWE-77page 21 of 75

Map vulnerabilities like CWE-77 to your infrastructure