Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2930 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-9223 1 Zohocorp 1 Applications Manager 2025-11-13 8.8 High
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
CVE-2025-63296 2 Keruistore, Tuya 2 K259 5mp Wifi, Tuya 2025-11-13 6.5 Medium
KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anyka_service.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root.
CVE-2024-57695 1 Agnitum 1 Outpost Security Suite 2025-11-13 7.7 High
An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. The manufacturer fixed the vulnerability in version 8.0 (4164.652.1856) from December 17, 2012.
CVE-2025-37138 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2025-11-13 6.2 Medium
An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-27083 1 Arubanetworks 1 Arubaos 2025-11-12 7.2 High
Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37133 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2025-11-12 7.2 High
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37134 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2025-11-12 7.2 High
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-12155 1 Google 1 Cloud Looker 2025-11-12 N/A
A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.192+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+
CVE-2025-53787 1 Microsoft 3 365, 365 Copilot, 365 Copilot Chat 2025-11-10 8.2 High
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
CVE-2025-53774 1 Microsoft 3 365, 365 Copilot, 365 Copilot Chat 2025-11-10 6.5 Medium
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
CVE-2025-53773 2 Github, Microsoft 3 Copilot, Visual Studio, Visual Studio 2022 2025-11-10 7.8 High
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2020-25079 1 Dlink 18 Dcs-2530l, Dcs-2530l Firmware, Dcs-2670l and 15 more 2025-11-08 8.8 High
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
CVE-2025-46365 1 Dell 1 Cloudlink 2025-11-07 5.3 Medium
Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink.
CVE-2025-23239 1 F5 12 Big-ip, Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager and 9 more 2025-11-07 8.7 High
When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2024-48659 2 Dcnetworks, Dcnglobal 3 Dcme-320-l, Dcme-320-l Firmware, Dcme-320-l Firmware 2025-11-07 9.8 Critical
An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component.
CVE-2025-50688 2 Twisted, Twistedmatrix 2 Twisted, Twistedweb 2025-11-06 6.5 Medium
A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file (e.g., a reverse shell script). Once uploaded, the attacker can trigger the execution of arbitrary commands on the target system, allowing for remote code execution. This could lead to escalation of privileges depending on the privileges of the web server process. The attack does not require physical access and can be conducted remotely, posing a significant risk to the confidentiality and integrity of the system.
CVE-2024-51115 2 Dcnetworks, Dcnglobal 3 Dcme-320, Dcme-320 Firmware, Dcme-320 Firmware 2025-11-06 9.8 Critical
DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability.
CVE-2025-60801 1 Jishenghua 1 Jsherp 2025-11-06 8.2 High
jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.
CVE-2025-59689 1 Libraesva 1 Email Security Gateway 2025-11-05 6.1 Medium
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.
CVE-2010-5330 1 Ui 1 Airos 2025-11-05 9.8 Critical
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.