CWE-78

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creati

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the fu

A vulnerability was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_tim

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` alw

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulne

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell comm

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the compon

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Bina

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Re

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative p

A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() fun

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zy

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Clic

Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amaz

Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command executi

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authentic

A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remot

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject a

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr par

Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator

A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. T

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain admini

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the comp

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of t

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote aut

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypas

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, al

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due t

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR9

RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary c