Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVEs (3,948)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2012-1823 8Apple DebianFedoraproject+5 more 17Application Stack Debian LinuxEnterprise Linux Desktop+14 more Apr 21, 2026 May 11, 2012 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers...Show more sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.Show less
CVE-2010-4345 4Canonical DebianExim+1 more 4Debian Linux EximOpensuse+1 more Apr 21, 2026 Dec 14, 2010 N/A· v4 7.8 HIGH· v3 6.9 MEDIUM· v2 Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated...Show more Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.Show less
CVE-2010-2008 3Canonical FedoraprojectOracle 3Fedora MysqlUbuntu Linux Apr 29, 2026 Jul 13, 2010 N/A· v4 N/A· v3 3.5 LOW· v2 MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (do...Show more MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.Show less
CVE-2010-0136 3Apache CanonicalDebian 3Debian Linux OpenofficeUbuntu Linux Apr 29, 2026 Feb 16, 2010 N/A· v4 N/A· v3 9.3 HIGH· v2 OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.
CVE-2007-3010 1Al Enterprise 1Omnipcx Enterprise Communication Server Apr 21, 2026 Sep 18, 2007 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a...Show more masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.Show less
CVE-2005-2793 1Phpldapadmin Project 1Phpldapadmin Apr 16, 2026 Sep 2, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_welcome_page parameter.
CVE-2005-2773 1Hp 1Openview Network Node Manager Apr 16, 2026 Sep 2, 2005 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, a...Show more HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.Show less
CVE-1999-0039 1Sgi 1Irix Apr 16, 2026 May 6, 1997 N/A· v4 7.3 HIGH· v3 7.5 HIGH· v2 webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter.

Previous 1...194 195 196 197198