← Back
CWE-78

6,175 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

JSON object

Loading...

CVEs (6,175)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-6592
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 31091.
CVE-2012-6591
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID...Show more
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116.Show less
CVE-2013-3444
1Cisco
8Application And Content Networking System Software
Enterprise Content Delivery Network SoftwareInternet Streamer Content Delivery System+5 more
Apr 29, 2026
Aug 1, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1; Cisco ACNS Software 4.x and 5.x before 5.5.29.2; Cisco ECDS Software 2.x before 2.5.6; Cisco CDS-IS...Show more
The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1; Cisco ACNS Software 4.x and 5.x before 5.5.29.2; Cisco ECDS Software 2.x before 2.5.6; Cisco CDS-IS Software 2.x before 2.6.3.b50 and 3.1.x before 3.1.2b54; Cisco VDS-IS Software 3.2.x before 3.2.1.b9; Cisco VDS-SB Software 1.x before 1.1.0-b96; Cisco VDS-OE Software 1.x before 1.0.1; and Cisco VDS-OS Software 1.x in central-management mode allows remote authenticated users to execute arbitrary commands by appending crafted strings to values in GUI fields, aka Bug IDs CSCug40609, CSCug48855, CSCug48921, CSCug48872, CSCuh21103, CSCuh21020, and CSCug56790.Show less
CVE-2013-1616
1Symantec
3Web Gateway
Web Gateway Appliance 8450Web Gateway Appliance 8490
Apr 29, 2026
Aug 1, 2013
N/A· v4
N/A· v3
8.3 HIGH· v2
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.
CVE-2013-4781
1Siemens
2Enterprise Openscape Branch
Openscape Session Border Controller
Apr 29, 2026
Jul 18, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0, and 7 before 7 R1.7.0, allows remote attackers to execute arbitrary commands via unspec...Show more
core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0, and 7 before 7 R1.7.0, allows remote attackers to execute arbitrary commands via unspecified vectors.Show less
CVE-2013-3578
1Wave
2Embassy Remote Administration Server
Embassy Remote Administration Server Help Desk
Apr 29, 2026
Jul 15, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearch...Show more
SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field), leading to execution of operating-system commands.Show less
CVE-2013-3576
1Hp
1System Management Homepage
Apr 29, 2026
Jun 14, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
CVE-2013-1947
1Kelly D. Redding
1Kelredd Pruview
Apr 29, 2026
Apr 25, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
CVE-2013-1933
1Documentcloud
1Karteek Docsplit
Apr 29, 2026
Apr 25, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a...Show more
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.Show less
CVE-2013-0804
1Novell
1Groupwise
Apr 29, 2026
Feb 24, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.
CVE-2013-0928
1Emc
1Alphastor
Apr 29, 2026
Jan 21, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation.
CVE-2012-5863
1Sinapsitech
4Esolar Duo Photovoltaic System Monitor
Esolar Light Photovoltaic System MonitorEsolar Photovoltaic System Monitor+1 more
Apr 29, 2026
Nov 23, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can exe...Show more
These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, unexpected, or dangerous commands directly onto the operating system.Show less
CVE-2012-3001
1Mutiny
1Standard
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
8.5 HIGH· v2
Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command injection vulnerability."
CVE-2012-4011
1Cybozu
1Kunai
Apr 29, 2026
Sep 8, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
CVE-2012-4361
1Hp
1San/iq
Apr 29, 2026
Aug 20, 2012
N/A· v4
N/A· v3
7.7 HIGH· v2
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.
CVE-2012-2986
1Hp
1San/iq
Apr 29, 2026
Aug 20, 2012
N/A· v4
N/A· v3
7.7 HIGH· v2
lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) first, (2) third, or (3) fourth parameter. NOT...Show more
lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) first, (2) third, or (3) fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361.Show less
CVE-2012-4177
1Ubi
1Uplay Pc
Apr 29, 2026
Aug 7, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.
CVE-2012-2976
1Symantec
1Web Gateway
Apr 29, 2026
Jul 23, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary shell commands via crafted input to application scripts, related to an "injection" issue.
CVE-2012-2953
1Symantec
1Web Gateway
Apr 29, 2026
Jul 23, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.
CVE-2012-2607
1Johnsoncontrols
2Network Controller
Network Controller Firmware
Apr 29, 2026
Jul 16, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
The Johnson Controls CK721-A controller with firmware before SSM4388_03.1.0.14_BB allows remote attackers to perform arbitrary actions via crafted packets to TCP port 41014 (aka the download port).