CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
classThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (4589)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-96951US | high8.8OT critical | KEV | ||
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-105134US | critical10.0OT critical | KEV | ||
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Ex… | ||||
| CVE-2026-8037US | critical9.8OT critical | KEV | ||
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster applian… | ||||
| CVE-2026-42271US | high8.8OT critical | KEV | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server befo… | ||||
| CVE-2026-22719US | —OT critical | KEV | ||
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote c… | ||||
| CVE-2025-59689US | —OT critical | KEV | ||
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been… | ||||
| CVE-2025-10035US | critical9.8OT critical | KEV | ||
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor… | ||||
| CVE-2025-4008US | high8.8OT critical | KEV | ||
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written i… | ||||
| CVE-2025-29635US | —OT critical | KEV | ||
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /g… | ||||
| CVE-2024-12987US | critical9.8OT critical | KEV | ||
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcf… | ||||
| CVE-2024-12356US | critical9.8OT critical | KEV | ||
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that… | ||||
| CVE-2024-55956US | critical9.8OT critical | KEV | ||
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the… | ||||
| CVE-2024-9380US | high7.2OT critical | KEV | ||
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code… | ||||
| CVE-2024-27348US | critical9.8OT critical | KEV | ||
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended t… | ||||
| CVE-2024-3400US | critical10.0OT critical | KEV | ||
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinc… | ||||
| CVE-2024-3273US | critical9.8OT critical | KEV | ||
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unkno… | ||||
| CVE-2024-21887US | critical9.1OT critical | KEV | ||
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send special… | ||||
| CVE-2023-39780US | high8.8OT critical | KEV | ||
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token… | ||||
| CVE-2023-20887US | critical9.8OT critical | KEV | ||
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a comma… | ||||
| CVE-2023-33538US | high8.8OT critical | KEV | ||
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm . | ||||
04
attack patterns (8)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan