Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2354 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-22671 1 Nsa 1 Ghidra 2025-04-07 9.8 Critical
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.
CVE-2025-25791 1 Yzncms 1 Yzncms 2025-04-07 4.4 Medium
An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVE-2023-0315 1 Froxlor 1 Froxlor 2025-04-07 8.8 High
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.
CVE-2024-51772 1 Arubanetworks 1 Clearpass Policy Manager 2025-04-07 6.4 Medium
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVE-2024-53672 1 Arubanetworks 1 Clearpass Policy Manager 2025-04-07 4.7 Medium
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.
CVE-2024-51771 1 Arubanetworks 1 Clearpass Policy Manager 2025-04-07 7.2 High
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary commands on the underlying operating system.
CVE-2025-29062 2025-04-07 9.8 Critical
An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead webservice.
CVE-2025-29063 2025-04-07 9.8 Critical
An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly.
CVE-2025-3249 2025-04-07 6.3 Medium
A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-10697 1 Tenda 2 Ac6, Ac6 Firmware 2025-04-05 6.3 Medium
A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-36783 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-04 9.8 Critical
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.
CVE-2024-30572 1 Netgear 2 R6850, R6850 Firmware 2025-04-04 8 High
Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter.
CVE-2025-25604 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6.5 Medium
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
CVE-2025-25605 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6.5 Medium
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.
CVE-2025-25768 1 Mrcms 1 Mrcms 2025-04-04 5.4 Medium
MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVE-2022-21191 1 Global-modules-path Project 1 Global-modules-path 2025-04-04 7.4 High
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
CVE-2024-34218 1 Totolink 2 Cp450, Cp450 Firmware 2025-04-04 3.8 Low
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter.
CVE-2024-53333 1 Totolink 2 Ex200, Ex200 Firmware 2025-04-04 6.3 Medium
TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the "ussd" parameter.
CVE-2024-32349 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6 Medium
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.
CVE-2024-32353 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 9.8 Critical
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.