Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVEs (3,617)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-27185 1Samba Client Project 1Samba Client Jun 17, 2026 Feb 10, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
CVE-2020-13117 1Wavlink 2Wn575a4 Firmware Wn579x3 Firmware Jun 17, 2026 Feb 9, 2021 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.
CVE-2021-26576 1Hpe 1Baseboard Management Controller Jun 17, 2026 Feb 8, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploadsshkey function.
CVE-2021-25172 1Hpe 1Baseboard Management Controller Jun 17, 2026 Feb 8, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetdefaultlangcfg function.
CVE-2020-2507 1Qnap 1Helpdesk Jun 17, 2026 Feb 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Hel...Show more The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.Show less
CVE-2021-0364 1Google 1Android Jun 17, 2026 Feb 3, 2021 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploi...Show more In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05458478; Issue ID: ALPS05458503.Show less
CVE-2021-0363 1Google 1Android Jun 17, 2026 Feb 3, 2021 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitat...Show more In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05458478.Show less
CVE-2021-0358 1Google 1Android Jun 17, 2026 Feb 3, 2021 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitatio...Show more In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442022.Show less
CVE-2021-0356 1Google 1Android Jun 17, 2026 Feb 3, 2021 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitatio...Show more In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442014.Show less
CVE-2020-8101 1Adt 1Lifeshield Diy Hd Video Doorbell Firmware Jun 17, 2026 Feb 2, 2021 N/A· v4 8.8 HIGH· v3 8.3 HIGH· v2 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on th...Show more Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.Show less
CVE-2021-1299 1Cisco 4Catalyst Sd Wan Manager Sd Wan FirmwareSd Wan Vbond Orchestrator+1 more Jun 17, 2026 Jan 20, 2021 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root pr...Show more Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1298 1Cisco 4Catalyst Sd Wan Manager Sd Wan FirmwareSd Wan Vbond Orchestrator+1 more Jun 17, 2026 Jan 20, 2021 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root pr...Show more Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1263 1Cisco 4Catalyst Sd Wan Manager Sd Wan FirmwareSd Wan Vbond Orchestrator+1 more Jun 17, 2026 Jan 20, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root pr...Show more Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1262 1Cisco 4Catalyst Sd Wan Manager Sd Wan FirmwareSd Wan Vbond Orchestrator+1 more Jun 17, 2026 Jan 20, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root pr...Show more Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1261 1Cisco 4Catalyst Sd Wan Manager Sd Wan FirmwareSd Wan Vbond Orchestrator+1 more Jun 17, 2026 Jan 20, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root pr...Show more Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1260 1Cisco 4Catalyst Sd Wan Manager Sd Wan FirmwareSd Wan Vbond Orchestrator+1 more Jun 17, 2026 Jan 20, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root pr...Show more Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2020-4688 1Ibm 1Security Guardium Jun 17, 2026 Jan 20, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injection vulnerability. IBM X-Force ID: 186700.
CVE-2020-14102 1Mi 2Ax1800 Firmware Rm1800 Firmware Jun 17, 2026 Jan 13, 2021 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800...Show more There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.Show less
CVE-2020-2508 1Qnap 2Qts Quts Hero Jun 17, 2026 Jan 11, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this...Show more A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later)Show less
CVE-2020-17504 1Barco 1Transform N Jun 17, 2026 Jan 8, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execu...Show more The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.Show less

Previous 1...152153154...181 Next