Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in unspecified command parameters, aka Bug IDs CSCtf19827 and CSCtf27788.

CVE-2012-4108NONECVSS 0.0EG 0.0

2013-10-13

The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID CSCtq86554.

CVE-2012-4177NONECVSS 0.0EG 0.0

2012-08-07

The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.

CVE-2012-4361NONECVSS 0.0EG 0.0

2012-08-20

lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.

CVE-2012-4981HIGHCVSS 8.8EG 8.8

2020-01-23

Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability

CVE-2012-5693HIGHCVSS 8.8EG 8.8

2020-01-03

Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the …

CVE-2012-5863NONECVSS 0.0EG 0.0

2012-11-23

These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, une…

CVE-2012-5878CRITICALCVSS 9.8EG 9.8

2020-01-03

Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the …

CVE-2012-6591NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116.

CVE-2012-6592NONECVSS 0.0EG 0.0

2013-08-31

Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 31091.

CVE-2012-6593NONECVSS 0.0EG 0.0

2013-08-31

Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 30088.

CVE-2012-6594NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref I…

CVE-2012-6595NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34595.

CVE-2012-6598NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33080.

CVE-2012-6599NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1.x before 4.1.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33476.

CVE-2012-6600NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 34502.

CVE-2012-6601NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 36983.

CVE-2012-6602NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 30122.

CVE-2012-6604NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 35249.

CVE-2012-6605NONECVSS 0.0EG 0.0

2013-08-31

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896.

CVE-2012-6610HIGHCVSS 8.8EG 8.8

2020-01-28

Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (semicolon) to the ping command feature.

CVE-2013-0517HIGHCVSS 7.8EG 7.8

2020-02-11

A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute arbitrary code.

CVE-2013-0804NONECVSS 0.0EG 0.0

2013-02-24

The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.

CVE-2013-0928NONECVSS 0.0EG 0.0

2013-01-21

The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation.

CVE-2013-10037CRITICALCVSS 9.3EG 0.0

2025-07-31

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauth…

CVE-2013-10039HIGHCVSS 8.7EG 0.0

2025-07-31

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payl…

CVE-2013-10048CRITICALCVSS 9.8EG 9.8

2025-08-01

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpo…

CVE-2013-10049CRITICALCVSS 9.3EG 0.0

2025-08-01

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to…

CVE-2013-10050HIGHCVSS 8.8EG 8.8

2025-08-01

An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied…

CVE-2013-10053HIGHCVSS 8.7EG 0.0

2025-08-01

A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. …

CVE-2013-10058HIGHCVSS 8.6EG 0.0

2025-08-01

An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied inpu…

CVE-2013-10059HIGHCVSS 7.2EG 7.2

2025-08-01

An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr…

CVE-2013-10060HIGHCVSS 7.2EG 7.2

2025-08-01

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary c…

CVE-2013-10061HIGHCVSS 7.2EG 7.2

2025-08-01

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from im…

CVE-2013-10069CRITICALCVSS 9.8EG 9.8

2025-08-05

The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter.…

CVE-2013-10073HIGHCVSS 8.8EG 8.8

2025-10-30

Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user w…

CVE-2013-1598HIGHCVSS 8.8EG 8.8

2020-01-24

A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code.

CVE-2013-1599CRITICALCVSS 9.8EG 9.8

2020-01-28

A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, …

CVE-2013-1616NONECVSS 0.0EG 0.0

2013-08-01

The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.

CVE-2013-1668NONECVSS 0.0EG 0.0

2014-05-23

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.

CVE-2013-1933NONECVSS 0.0EG 0.0

2013-04-25

The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.

CVE-2013-1947NONECVSS 0.0EG 0.0

2013-04-25

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.

CVE-2013-2024HIGHCVSS 8.8EG 8.8

2019-10-31

OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.

CVE-2013-2060CRITICALCVSS 9.8EG 9.8

2020-01-28

The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.

CVE-2013-2512CRITICALCVSS 9.8EG 9.8

2021-01-26

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.

CVE-2013-2568CRITICALCVSS 9.8EG 9.8

2020-01-29

A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user execute arbitrary code.

CVE-2013-2570CRITICALCVSS 9.8EG 9.8

2020-01-29

A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a remove malicious user execute arbitrary code.

CVE-2013-2573CRITICALCVSS 9.8EG 9.8

2020-01-29

A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. and 4171G 1.6.18P12s, which could let a malicious user execute arbitrary code.

CVE-2013-2578NONECVSS 0.0EG 0.0

2013-10-11

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in…

CVE-2013-2612CRITICALCVSS 9.8EG 9.8

2020-01-27

Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary shell commands with root privileges due to an error in the Web UI.

CWE-78— OS Command Injection

CVEs classified under CWE-78page 3 of 111

Map vulnerabilities like CWE-78 to your infrastructure