Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVEs (3,618)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-39781 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can...Show more Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `restart_hour` POST parameter.Show less
CVE-2024-39765 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An a...Show more Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `custom_interface` POST parameter.Show less
CVE-2024-39764 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An a...Show more Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `dest` POST parameter.Show less
CVE-2024-39763 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An a...Show more Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `gateway` POST parameter.Show less
CVE-2024-39762 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An a...Show more Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `netmask` POST parameter.Show less
CVE-2024-39761 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker c...Show more Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists within the `restart_week_value` POST parameter.Show less
CVE-2024-39760 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker c...Show more Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists within the `restart_min_value` POST parameter.Show less
CVE-2024-39759 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker c...Show more Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists within the `restart_hour_value` POST parameter.Show less
CVE-2024-39367 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attac...Show more An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Show less
CVE-2024-39360 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an...Show more An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Show less
CVE-2024-37186 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make a...Show more An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Show less
CVE-2024-34166 1Wavlink 1Wl Wn533a8 Firmware Jun 17, 2026 Jan 14, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An...Show more An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.Show less
CVE-2025-0396 - - Jun 17, 2026 Jan 12, 2025 8.5 HIGH· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command...Show more A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2024-57228 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 8.0 HIGH· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
CVE-2024-57227 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 8.0 HIGH· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
CVE-2024-57226 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 8.0 HIGH· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
CVE-2024-57225 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
CVE-2024-57224 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVE-2024-57223 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
CVE-2024-57222 1Linksys 1E7350 Firmware Jun 17, 2026 Jan 10, 2025 N/A· v4 6.3 MEDIUM· v3 N/A· v2 Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.

Previous 1...737475...181 Next