CWE-78— OS Command Injection

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.— MITRE CWE catalog

7,004 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-78page 17 of 141

CVE-2025-11202CRITICALCVSS 9.8EG 9.8
2025-10-29
win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not requir…
CVE-2018-25120CRITICALCVSS 9.8EG 9.8
2025-10-29
D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_…
CVE-2025-12296CRITICALCVSS 9.8EG 9.8
2025-10-27
A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated r…
CVE-2025-60803CRITICALCVSS 9.8EG 9.8
2025-10-24
Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register.
CVE-2016-15048CRITICALCVSS 9.8EG 9.8
2025-10-22
AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parame…
CVE-2025-6542CRITICALCVSS 9.8EG 9.8
2025-10-21
An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
CVE-2025-11900CRITICALCVSS 9.8EG 9.8
2025-10-17
The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
CVE-2025-34513CRITICALCVSS 9.8EG 9.8
2025-10-16
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vul…
CVE-2025-11665CRITICALCVSS 9.8EG 9.8
2025-10-13
A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be init…
CVE-2025-11491CRITICALCVSS 9.8EG 9.8
2025-10-08
A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to …
CVE-2025-11490CRITICALCVSS 9.8EG 9.8
2025-10-08
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to …
CVE-2025-11407CRITICALCVSS 9.8EG 9.8
2025-10-07
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. Th…
CVE-2025-59741CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-59740CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-59739CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-59738CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-59737CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-59736CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-59735CRITICALCVSS 9.8EG 9.8
2025-10-02
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned…
CVE-2025-61045CRITICALCVSS 9.8EG 9.8
2025-10-01
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.
CVE-2025-10659CRITICALCVSS 9.8EG 9.8
2025-09-30
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular express…
CVE-2025-9762CRITICALCVSS 9.8EG 9.8
2025-09-30
The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated at…
CVE-2025-11148CRITICALCVSS 9.8EG 9.8
2025-09-30
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows t…
CVE-2025-11005CRITICALCVSS 9.8EG 9.8
2025-09-25
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.
CVE-2025-59834CRITICALCVSS 9.8EG 9.8
2025-09-25
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part…
CVE-2025-52906CRITICALCVSS 9.8EG 9.8
2025-09-24
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
CVE-2025-56819CRITICALCVSS 9.8EG 9.8
2025-09-24
An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
CVE-2025-10568CRITICALCVSS 9.8EG 9.8
2025-09-19
HyperX NGENUITY software is potentially vulnerable to arbitrary code execution. HP is releasing updated software to address the potential vulnerability.
CVE-2025-23316CRITICALCVSS 9.8EG 9.8
2025-09-17
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by manipulating the model name parameter in the model control APIs. A successful exp…
CVE-2025-9972CRITICALCVSS 9.8EG 9.8
2025-09-17
Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device.
CVE-2025-34184CRITICALCVSS 9.8EG 9.8
2025-09-16
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd'…
CVE-2025-34186CRITICALCVSS 9.8EG 9.8
2025-09-16
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate c…
CVE-2025-59361CRITICALCVSS 9.8EG 9.8
2025-09-15
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVE-2025-59360CRITICALCVSS 9.8EG 9.8
2025-09-15
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVE-2025-59359CRITICALCVSS 9.8EG 9.8
2025-09-15
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVE-2025-54123CRITICALCVSS 9.8EG 9.8
2025-09-10
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validatio…
CVE-2025-55048CRITICALCVSS 9.8EG 9.8
2025-09-09
Multiple CWE-78
CVE-2025-58371CRITICALCVSS 9.8EG 9.8
2025-09-05
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input a…
CVE-2025-55037CRITICALCVSS 9.8EG 9.8
2025-09-05
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote unauthe…
CVE-2025-54857CRITICALCVSS 9.8EG 9.8
2025-09-01
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If exploited, a remote unauthenticated attacker may execute arbitrary OS commands wit…
CVE-2025-9752CRITICALCVSS 9.8EG 9.8
2025-09-01
A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgi_main of the file soap.cgi of the component SOAP Service. Such manipulation of the argument service leads to os command injection. The…
CVE-2025-9727CRITICALCVSS 9.8EG 9.8
2025-08-31
A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgi_main of the file /soap.cgi. This manipulation of the argument service causes os command injection. Remote exploitation of the attack i…
CVE-2024-46484CRITICALCVSS 9.8EG 9.8
2025-08-29
TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.
CVE-2025-55583CRITICALCVSS 9.8EG 9.8
2025-08-28
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly…
CVE-2025-9424CRITICALCVSS 9.8EG 9.8
2025-08-25
A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Affected by this vulnerability is an unknown functionality of the file /itbox_pi/branch_import.php?a=branch_list. Such manipulation of the argument province leads to os command …
CVE-2025-9387CRITICALCVSS 9.8EG 9.8
2025-08-24
A vulnerability was found in DCN DCME-720 9.1.5.11. This affects an unknown function of the file /usr/local/www/function/audit/newstatistics/ip_block.php of the component Web Management Backend. Performing manipulation of the argument ip r…
CVE-2025-3128CRITICALCVSS 9.8EG 9.8
2025-08-21
A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the…
CVE-2011-10026CRITICALCVSS 9.8EG 9.8
2025-08-20
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] paramete…
CVE-2025-9026CRITICALCVSS 9.8EG 9.8
2025-08-15
A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads to os command injection. It is possible…
CVE-2025-43984CRITICALCVSS 9.8EG 9.8
2025-08-14
An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unauthenticated /goform/goform_set_cmd_process requests. A crafted POST request, usin…

Map vulnerabilities like CWE-78 to your infrastructure

EchelonGraph correlates every CVE — across CWE-78 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →