CWE-78
MITRE ↗Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote atta
A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attack
A vulnerability in the NX-API management application programming interface (API) in devices running, or based on, Cisco
TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary c
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attac
The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices al
A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allo
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow auth
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authe
OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the co
OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute a
OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute a
OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute a
OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute a
A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authentic
fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters i
Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmwa
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
Main_Analysis_Content.asp in ASUS DSL-N12E_C1 1.1.2.3_345 is prone to Authenticated Remote Command Execution, which allo
A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authentic
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST
Frequently Asked Questions
What is CWE-78?
CWE-78 (Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.
How many CVEs are classified as CWE-78?
There are 7,691 CVE records associated with CWE-78 in our database. Of these, 1941 are critical severity, 3146 are high severity, and 963 are medium severity.
How can I protect against CWE-78 vulnerabilities?
Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-78 using AI-powered security agents.
Detect CWE-78 Vulnerabilities
CyberStrike's AI agents automatically detect improper neutralization of special elements used in an os command (os command injection) vulnerabilities across your infrastructure.
Get Started