← Back
CWE-78

5,885 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

JSON object

Loading...

CVEs (5,885)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-1000216
1Ruckus
1Wireless H500
May 6, 2026
Oct 10, 2016
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Ruckus Wireless H500 web management interface authenticated command injection
CVE-2016-6414
1Cisco
1Ios
May 6, 2026
Sep 22, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux commands on the guest OS via crafted iox command-line options, aka Bug ID CSCuz59223.
CVE-2016-6373
1Cisco
1Cloud Services Platform 2100
May 6, 2026
Sep 22, 2016
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
The web-based GUI in Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541.
CVE-2016-4965
1Fortinet
1Fortiwan
May 6, 2026
Sep 21, 2016
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_con...Show more
Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.Show less
CVE-2016-1482
1Cisco
1Webex Meetings Server
May 6, 2026
Sep 17, 2016
N/A· v4
8.1 HIGH· v3
9.3 HIGH· v2
Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130.
CVE-2016-4853
1Akabei Soft2
1Happy Wardrobe
May 6, 2026
Sep 2, 2016
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe.
CVE-2016-5679
2Netgear
Nuuo
2Nvrmini 2
Readynas Surveillance
May 6, 2026
Aug 31, 2016
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_...Show more
cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.Show less
CVE-2016-1468
1Cisco
1Telepresence Video Communication Server
May 6, 2026
Aug 8, 2016
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary commands via crafted fields, aka Bug ID CSCuv12531.
CVE-2015-6396
1Cisco
3Rv110w Wireless N Vpn Firewall Firmware
Rv130w Wireless N Multifunction Vpn Router FirmwareRv215w Wireless N Vpn Router Firmware
May 6, 2026
Aug 8, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrator via crafted parameters, aka Bug IDs CSCuv90134, CSCux58161, and CSCux73567.
CVE-2016-6147
1Sap
1Trex
May 6, 2026
Aug 5, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors, aka SAP Security Note 2234226.
CVE-2015-7611
1Apache
1James Server
May 6, 2026
Jun 7, 2016
N/A· v4
8.1 HIGH· v3
9.3 HIGH· v2
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
CVE-2015-4642
1Php
1Php
May 6, 2026
May 16, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an applica...Show more
The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.Show less
CVE-2016-1339
1Cisco
1Unified Computing System Platform Emulator
May 6, 2026
Apr 16, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Cisco Unified Computing System (UCS) Platform Emulator 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832.
CVE-2016-1352
1Cisco
1Unified Computing System Central Software
May 6, 2026
Apr 14, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuv33856.
CVE-2016-3655
1Paloaltonetworks
1Pan Os
May 6, 2026
Apr 12, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API ca...Show more
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.Show less
CVE-2016-1297
1Cisco
1Application Control Engine Software
May 6, 2026
Feb 26, 2016
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via...Show more
The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801.Show less
CVE-2015-7769
1Basercms
1Basercms
May 6, 2026
Feb 19, 2016
N/A· v4
6.3 MEDIUM· v3
6.5 MEDIUM· v2
baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVE-2015-8151
1Symantec
1Encryption Management Server
May 6, 2026
Feb 18, 2016
N/A· v4
9.1 CRITICAL· v3
5.8 MEDIUM· v2
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access.
CVE-2015-4956
1Ibm
1Qradar Security Information And Event Manager
May 6, 2026
Feb 15, 2016
N/A· v4
7.4 HIGH· v3
6.5 MEDIUM· v2
The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.
CVE-2016-1320
1Cisco
1Prime Collaboration
May 6, 2026
Feb 12, 2016
N/A· v4
6.7 MEDIUM· v3
6.8 MEDIUM· v2
The CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS commands as root by leveraging administrator privileges, aka Bug ID CSCux69286.