CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
classThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (4589)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-96951US | high8.8OT kritisch | KEV | ||
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-105134US | critical10.0OT kritisch | KEV | ||
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Ex… | ||||
| CVE-2026-8037US | critical9.8OT kritisch | KEV | ||
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster applian… | ||||
| CVE-2026-42271US | high8.8OT kritisch | KEV | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server befo… | ||||
| CVE-2026-22719US | —OT kritisch | KEV | ||
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote c… | ||||
| CVE-2025-59689US | —OT kritisch | KEV | ||
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been… | ||||
| CVE-2025-10035US | critical9.8OT kritisch | KEV | ||
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor… | ||||
| CVE-2025-4008US | high8.8OT kritisch | KEV | ||
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written i… | ||||
| CVE-2025-29635US | —OT kritisch | KEV | ||
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /g… | ||||
| CVE-2024-12987US | critical9.8OT kritisch | KEV | ||
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcf… | ||||
| CVE-2024-12356US | critical9.8OT kritisch | KEV | ||
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that… | ||||
| CVE-2024-55956US | critical9.8OT kritisch | KEV | ||
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the… | ||||
| CVE-2024-9380US | high7.2OT kritisch | KEV | ||
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code… | ||||
| CVE-2024-27348US | critical9.8OT kritisch | KEV | ||
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended t… | ||||
| CVE-2024-3400US | critical10.0OT kritisch | KEV | ||
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinc… | ||||
| CVE-2024-3273US | critical9.8OT kritisch | KEV | ||
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unkno… | ||||
| CVE-2024-21887US | critical9.1OT kritisch | KEV | ||
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send special… | ||||
| CVE-2023-39780US | high8.8OT kritisch | KEV | ||
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token… | ||||
| CVE-2023-20887US | critical9.8OT kritisch | KEV | ||
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a comma… | ||||
| CVE-2023-33538US | high8.8OT kritisch | KEV | ||
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm . | ||||
04
Angriffsmuster (8)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan