CWE-78 <span class="text-2xl md:text-3xl font-bold ml-2" style="color:var(--text-secondary)">— OS Command Injection

CVE-2023-44425HIGHCVSS 8.0EG 8.0

D-Link DIR-X3260 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Altho…

CVE-2023-44426HIGHCVSS 8.0EG 8.0

D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. A…

CVE-2023-44427HIGHCVSS 8.0EG 8.0

D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 router…

CVE-2023-4464HIGHCVSS 7.2EG 7.2

D-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 rout…

2023-12-29

A vulnerability, which was classified as critical, has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, ED…

CVE-2023-4473CRITICALCVSS 9.8EG 9.8

2023-11-30

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands b…

CVE-2023-4474CRITICALCVSS 9.8EG 9.8

2023-11-30

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system …

CVE-2023-45025CRITICALCVSS 9.0EG 9.0

CVE-2023-45158CRITICALCVSS 9.8EG 9.8

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the …

2023-10-16

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on th…

CVE-2023-4542MEDIUMCVSS 6.3EG 9.0

2023-08-25

A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injectio…

CVE-2023-45467CRITICALCVSS 9.8EG 9.8

2023-10-13

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.

CVE-2023-45741MEDIUMCVSS 6.8EG 6.8

2023-12-26

VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands.

CVE-2023-46117HIGHCVSS 8.8EG 8.8

2023-10-20

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of …

CVE-2023-46157HIGHCVSS 8.8EG 8.8

2023-12-08

File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing file permissions to 4755.

CVE-2023-46306HIGHCVSS 8.4EG 8.4

2023-10-22

The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_…

CVE-2023-46359CRITICALCVSS 9.8EG 9.8

CVE-2023-46454CRITICALCVSS 9.8EG 9.8

An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the …

2023-12-12

In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.

CVE-2023-46510CRITICALCVSS 9.8EG 9.8

2023-10-27

An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings/setPasswordCfg function.

CVE-2023-46683HIGHCVSS 7.2EG 7.2

CVE-2023-47104CRITICALCVSS 9.8EG 9.8

A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrar…

2023-10-30

tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, wh…

CVE-2023-47105HIGHCVSS 8.6EG 8.6

2024-09-18

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.

CVE-2023-4711MEDIUMCVSS 5.0EG 5.0

2023-09-01

A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os …

CVE-2023-47167HIGHCVSS 7.2EG 7.2

CVE-2023-47209HIGHCVSS 7.2EG 7.2

A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injectio…

CVE-2023-47218MEDIUMCVSS 5.8EG 9.0

A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command inject…

2024-02-13

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the …

CVE-2023-47220MEDIUMCVSS 6.6EG 6.6

CVE-2023-47254CRITICALCVSS 9.8EG 9.8

An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability …

2023-12-09

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.

CVE-2023-47415HIGHCVSS 7.5EG 7.5

2024-03-07

Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.

CVE-2023-47540MEDIUMCVSS 6.7EG 6.7

2024-04-09

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all…

CVE-2023-47560HIGHCVSS 7.4EG 7.4

2024-01-05

An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version…

CVE-2023-47562HIGHCVSS 7.4EG 7.4

CVE-2023-47563HIGHCVSS 7.4EG 7.4

An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following v…

2024-09-06

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following v…

CVE-2023-47565HIGHCVSS 8.0EG 9.0⚠ KEV

2023-12-08

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fix…

CVE-2023-47566MEDIUMCVSS 6.7EG 6.7

CVE-2023-47567MEDIUMCVSS 4.7EG 4.7

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…

CVE-2023-47617HIGHCVSS 7.2EG 7.2

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…

CVE-2023-47618HIGHCVSS 7.2EG 7.2

A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command in…

CVE-2023-47675HIGHCVSS 7.2EG 7.2

A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execu…

2023-11-17

CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.

CVE-2023-47709CRITICALCVSS 9.1EG 9.1

2024-05-14

IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 271524.

CVE-2023-47802HIGHCVSS 7.2EG 7.2

2024-06-28

A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute ar…

CVE-2023-48380HIGHCVSS 7.4EG 7.4

2023-12-15

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command inj…

CVE-2023-48428HIGHCVSS 7.2EG 7.2

2023-12-12

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly check uploaded certificates. A malicious admin could upload a crafted certifica…

CVE-2023-4855HIGHCVSS 7.2EG 7.2

2024-04-15

A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized commands via IPMI.

CVE-2023-4856HIGHCVSS 8.8EG 8.8

2024-04-15

A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint.

CVE-2023-48662HIGHCVSS 7.2EG 7.2

CVE-2023-48663HIGHCVSS 7.2EG 7.2

Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the aff…

CVE-2023-48664HIGHCVSS 7.2EG 7.2

Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the aff…

CVE-2023-48665HIGHCVSS 7.2EG 7.2

Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the aff…

CVE-2023-48667HIGHCVSS 7.2EG 7.2

Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the aff…