CWE-78
7,140 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVEs (7,140)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file. |
1Canonical 2Ltsp Display Manager Ubuntu LinuxMay 6, 2026 May 21, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window. |
rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands. |
costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request. |
1Bluecoat 2Content Analysis System Content Analysis System SoftwareMay 6, 2026 Apr 30, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection." |
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1...Show more |
Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. |
2Python Pythonware2Pillow Python Imaging LibraryMay 6, 2026 Apr 27, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py...Show more |
2Asus T Mobile3Rt Ac68u Rt Ac68u FirmwareTm Ac1900May 6, 2026 Apr 22, 2014 N/A· v4 N/A· v3 8.5 HIGH· v2 The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metach...Show more |
cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues...Show more |
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context. |
1Xangati 2Xangati Software Release Xangati XnrMay 6, 2026 Apr 15, 2014 N/A· v4 N/A· v3 9.0 HIGH· v2 Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer. |
1Zyxel 2N300 Netusb Nbg 419n N300 Netusb Nbg 419n FirmwareMay 6, 2026 Apr 15, 2014 N/A· v4 N/A· v3 7.9 HIGH· v2 The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand...Show more |
1Sophos 2Web Appliance Web Appliance FirmwareMay 6, 2026 Apr 11, 2014 N/A· v4 N/A· v3 8.5 HIGH· v2 The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter. |
1Alliedtelesis 8At Rg634a At Rg634a FirmwareImg616lh+5 moreMay 6, 2026 Mar 31, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary...Show more |
1Ibm 1Lotus Protector For Mail Security May 6, 2026 Mar 25, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors. |
1Ibm 1Lotus Protector For Mail Security May 6, 2026 Mar 25, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors. |
1Sophos 2Web Appliance Web Appliance FirmwareMay 6, 2026 Mar 18, 2014 N/A· v4 N/A· v3 9.3 HIGH· v2 Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the user_workstation variable in a customize...Show more |
delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metac...Show more |
TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) wan network prefix to internet/ipv6.asp; (2) remote port to adm/management.asp; (3) pptp user...Show more |