CWE-77

ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote

Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitr

Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Supe

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthor

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remo

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a comma

SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a S

A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartCo

A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTo

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with re

Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary comm

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command

A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCoun

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boafor

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file

In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir f

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before vers

EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can su

ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distribu

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to impro

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between appro

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknow

Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the ga

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_t

Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an au

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_l

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.s

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the fi

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the fi

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows a

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) comm

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the

A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Ad

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attack