egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.

CVE-2022-4515HIGHCVSS 7.8EG 9.8

2022-12-20

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution bec…

CVE-2022-45461HIGHCVSS 7.5EG 8.8

2022-11-17

The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root.

CVE-2022-45497CRITICALCVSS 9.8EG 9.8

2022-12-08

Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand.

CVE-2022-45506CRITICALCVSS 9.8EG 9.8

2022-12-08

Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName.

CVE-2022-45639HIGHCVSS 7.8EG 9.8

2023-01-24

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the bac…

CVE-2022-45699CRITICALCVSS 9.8EG 9.8

2023-02-10

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.

CVE-2022-45709CRITICALCVSS 9.8EG 9.8

2022-12-23

IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule parameters in the formSetDebugCfg function.

CVE-2022-45711CRITICALCVSS 9.8EG 9.8

2022-12-23

IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckTools function.

CVE-2022-45717CRITICALCVSS 9.8EG 9.8

2022-12-23

IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount function. This vulnerability is exploited via a crafted GET request.

CVE-2022-45768HIGHCVSS 8.8EG 8.8

2023-02-07

Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker to execute arbitrary code via the formWlanMP function.

CVE-2022-45899MEDIUMCVSS 6.5EG 6.5

2026-05-08

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.

CVE-2022-45915HIGHCVSS 8.8EG 8.8

2022-12-07

ILIAS before 7.16 allows OS Command Injection.

CVE-2022-45939HIGHCVSS 7.8EG 7.8

2022-11-28

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a v…

CVE-2022-45942HIGHCVSS 8.8EG 8.8

2022-12-20

A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.

CVE-2022-45977HIGHCVSS 8.8EG 8.8

2022-12-12

Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.

CVE-2022-45996HIGHCVSS 7.2EG 7.2

2022-12-12

Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.

CVE-2022-46169CRITICALCVSS 9.8EG 9.8⚠ KEV

2022-12-05

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbit…

CVE-2022-46303HIGHCVSS 8.0EG 7.5

2023-02-20

Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitr…

CVE-2022-46304HIGHCVSS 8.8EG 8.8

2023-01-03

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers comman…

CVE-2022-46361MEDIUMCVSS 6.9EG 6.9

2023-05-30

An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted co…

CVE-2022-4643MEDIUMCVSS 6.3EG 6.3

2022-12-21

A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The a…

CVE-2022-46476CRITICALCVSS 9.8EG 9.8

2023-01-19

D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.

CVE-2022-46538CRITICALCVSS 9.8EG 9.8

2022-12-20

Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac.

CVE-2022-46552HIGHCVSS 8.8EG 8.8

2023-02-02

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.

CVE-2022-46597CRITICALCVSS 9.8EG 9.8

2022-12-30

TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function.

CVE-2022-46598CRITICALCVSS 9.8EG 9.8

2022-12-30

TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_5g function.

CVE-2022-46631CRITICALCVSS 9.8EG 9.8

2022-12-15

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCfg function.

CVE-2022-46634CRITICALCVSS 9.8EG 9.8

2022-12-15

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg function.

CVE-2022-46649HIGHCVSS 8.8EG 8.8

2023-02-10

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device.

CVE-2022-47208HIGHCVSS 8.8EG 8.8

2022-12-16

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the d…

CVE-2022-47210HIGHCVSS 7.8EG 7.8

2022-12-16

The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any auth…

CVE-2022-47339MEDIUMCVSS 6.7EG 6.7

2023-02-12

In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.

CVE-2022-47555CRITICALCVSS 9.3EG 9.3

2023-09-19

Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.

CVE-2022-47616HIGHCVSS 7.2EG 7.2

2023-06-02

Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrar…

CVE-2022-47853CRITICALCVSS 9.8EG 9.8

2023-01-17

TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.

CVE-2022-47911CRITICALCVSS 9.1EG 7.2

2023-01-18

Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensiti…

CVE-2022-48069HIGHCVSS 7.5EG 7.5

2023-01-27

Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.

CVE-2022-48070HIGHCVSS 7.8EG 7.8

2023-01-27

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.

CVE-2022-48072HIGHCVSS 7.8EG 7.8

2023-01-27

Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.

CVE-2022-48107CRITICALCVSS 9.8EG 9.8

2023-01-27

D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.

CVE-2022-48108CRITICALCVSS 9.8EG 9.8

2023-01-27

D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.

CVE-2022-48121CRITICALCVSS 9.8EG 9.8

2023-01-20

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.

CVE-2022-48122CRITICALCVSS 9.8EG 9.8

2023-01-20

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.

CVE-2022-48123CRITICALCVSS 9.8EG 9.8

2023-01-20

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.

CVE-2022-48124CRITICALCVSS 9.8EG 9.8

2023-01-20

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.

CVE-2022-48125CRITICALCVSS 9.8EG 9.8

2023-01-20

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function.

CVE-2022-48126CRITICALCVSS 9.8EG 9.8

2023-01-20

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.

CVE-2022-48252CRITICALCVSS 9.8EG 9.8

2023-01-11

The jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command Injection.

CVE-2022-48337CRITICALCVSS 9.8EG 9.8

2023-02-20

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a v…

CWE-78— OS Command Injection

CVEs classified under CWE-78page 56 of 111

Map vulnerabilities like CWE-78 to your infrastructure