CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
baseThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (7917)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106931US | —OT critical | KEV | ||
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system r… | ||||
| CVE-2026-110447US | —OT critical | KEV | ||
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a… | ||||
| CVE-2026-105134US | critical10.0OT critical | KEV | ||
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Ex… | ||||
| CVE-2026-83549US | —OT critical | KEV | ||
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management… | ||||
| CVE-2026-74233US | critical9.8OT critical | — | ||
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516,… | ||||
| CVE-2026-73570US | —OT critical | KEV | ||
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due… | ||||
| CVE-2026-16812US | —OT critical | KEV | ||
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successf… | ||||
| CVE-2026-49869US | —OT critical | KEV | ||
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whiteli… | ||||
| CVE-2026-25089US | —OT critical | KEV | ||
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through… | ||||
| CVE-2026-10520US | —OT critical | KEV | ||
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execu… | ||||
| CVE-2026-42271US | high8.8OT critical | KEV | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server befo… | ||||
| CVE-2026-39808US | —OT critical | KEV | ||
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execut… | ||||
| CVE-2026-34197US | —OT critical | KEV | ||
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the… | ||||
| CVE-2025-67038US | —OT critical | KEV | ||
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concat… | ||||
| CVE-2026-22719US | —OT critical | KEV | ||
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote c… | ||||
| CVE-2026-25108US | high8.8OT critical | KEV | ||
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arb… | ||||
| CVE-2026-1731US | critical9.8OT critical | KEV | ||
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending s… | ||||
| CVE-2025-66644US | critical9.8OT critical | KEV | ||
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. | ||||
| CVE-2025-58034US | —OT critical | KEV | ||
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWe… | ||||
| CVE-2025-64328US | high7.2OT critical | KEV | ||
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrat… | ||||
03
attack patterns (5)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan