Advisories · Weakness
Command injection.
Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.8 High
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
- Fedora
- Fedora Extra Packages for Enterprise Linux (EPEL)
- Command injection
- CVSS 6.9 Medium
HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
- HKUDS nanobot
- Other injection
- Command injection
- CVSS 5.1 Medium
magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
- magicblack MacCMS10
- Command injection
- CVSS 5.1 Medium
D-Link DWR-M921 formWsc os command injection
- D-Link DWR-M921
- Command injection
- CVSS 5.1 Medium
D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
- D-Link DWR-M921
- Command injection
- CVSS 5.1 Medium
D-Link DWR-M921 formDiskPartition system command injection
- D-Link DWR-M921
- Other injection
- Command injection
- CVSS 7.8 High
Parallels Desktop local privilege escalation via appliance extract argument injection
- Parallels Desktop for Mac
- Command injection
- Privilege escalation
- CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DWR-M921 formDiskCreateShare system os command injection
- D-Link DWR-M921
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DWR-M921 formDiskFormat system os command injection
- D-Link DWR-M921
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection
- D-Link DWR-M920
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd. SV-CPT-MC310 and others
- Contec Co., Ltd. SV-CPT-MC310
- Contec Co., Ltd. SV-CPT-MC310F
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd. CAN-2-WF and others
- Contec Co., Ltd. CAN-2-WF
- Contec Co., Ltd. CAN-2-USB
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd CPS-TM341G5MB-ADSC1-931 and others
- Contec Co., Ltd CPS-TM341G5MB-ADSC1-931
- Contec Co., Ltd CPS-TM341MB-ADSC1-931
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd. Integrated Type CPS-PC341[][]-*-9201 and others
- Contec Co., Ltd. Integrated Type CPS-PC341[][]-*-9201
- Contec Co., Ltd. Configurable type CPS-PCS341[][]-DS1-1201
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd. M2M Gateway Integrated Type CPS-MG341* and others
- Contec Co., Ltd. M2M Gateway Integrated Type CPS-MG341*
- Contec Co., Ltd. M2M Gateway Configurable type CPS-MGS341*
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd. SGA1000
- Contec Co., Ltd. SGA1000
- Command injection
- CVSS 8.7 High
OS command injection in Contec Co., Ltd. FXA5000 and others
- Contec Co., Ltd. FXA5000
- Contec Co., Ltd. FXA5020
- Command injection
- CVSS 6.9 Medium
0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection
- 0x4m4 HexStrike AI
- Command injection
- CVSS 5.3 Medium
ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection
- ipa-lab HackingBuddyGPT
- Command injection
- CVSS 6.9 Medium
0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection
- 0x4m4 HexStrike AI
- Command injection
- CVSS 6.9 Medium
GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection
- GH05TCREW PentestAgent
- Command injection
- CVSS 6.9 Medium
GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection
- GH05TCREW PentestAgent
- Command injection
- CVSS 2.7 Low
Argument injection in Paessler PRTG Network Monitor
- Paessler PRTG Network Monitor
- Command injection
- CVSS 2.7 Low
Argument injection in Paessler PRTG Network Monitor
- Paessler PRTG Network Monitor
- Command injection
- CVSS 8.7 High
Spug through 3.4.0 Remote Code Execution via ping_check
- spug
- Command injection
- CVSS 5.3 Medium
webgjc web_robot web.py controller_recover os command injection
- webgjc web_robot
- Command injection
- CVSS 3.1 Low
OS command injection in LB-LINK AC1900 firmware
- LB-LINK AC1900 firmware
- Command injection
- CVSS 6.3 Medium
aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
- cole aiosmtplib
- Command injection
- CVSS 8.7 High
OS Command Injection in Malcolm
- CISA Malcolm
- Command injection
- CVSS 8.4 High
OS command injection in the task synthesis component in projen
- AWS projen
- Command injection
- CVSS 8.4 High
OS Command Injection in TUBITAK BILGEM's Pardus Software
- TUBITAK BILGEM Software Technologies Research Institute Pardus Software
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server
- WAVLINK Technology WN535M1
- WAVLINK Technology WN535M3
- Command injection
- CVSS 7.8 High
OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair
- TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair
- Command injection
- CVSS 8.6 High
Command Injection in Puppet Enterprise
- Perforce Software Puppet Enterprise
- Command injection
- Privilege escalation
- CVSS 3.3 Low
Argument Injection in TUBITAK BILGEM's Pardus Pen
- TUBITAK BILGEM Software Technologies Research Institute Pardus Pen
- Command injection
- CVSS 7.7 HighCritical · CVSS 7+ and EPSS
OS Command Injection Vulnerability in Deco Devices
- TP-Link Systems Inc. Deco BE11000 V2
- TP-Link Systems Inc. Deco M9 Plus V2
- Command injection
- CVSS 7.5 High
@argos-ci/core: CI Branch Name OS Command Injection
- Command injection
<6.2.1 · fixed in 6.2.1
GHSA-4x45-gxvp-6283 · CVE-2026-59960 - CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 8.8 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Command injection
- CVSS 8.8 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Command injection
- CVSS 8.8 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Command injection
- CVSS 8.8 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Command injection
- CVSS 8.4 High
OS command injection in Lenovo Tianxi AI Agent PC Application
- Lenovo Tianxi AI Agent PC Application
- Command injection
- CVSS 8.6 High
FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
- FileRun
- Command injection
- CVSS 8.7 High
FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
- FileRun
- Command injection
- CVSS 9.5 CriticalCritical · CVSS 9+
OS command injection in WebPros ConfigServer Security & Firewall and others
- WebPros ConfigServer Security & Firewall
- ConfigServer Security & Firewall
- Command injection
- CVSS 9.2 CriticalCritical · CVSS 9+
OS command injection in WebPros ConfigServer Security & Firewall and others
- WebPros ConfigServer Security & Firewall
- ConfigServer Security & Firewall
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
OS command injection in Dell ThinOS 10
- Dell ThinOS 10
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
OS command injection in Dell ThinOS 10
- Dell ThinOS 10
- Command injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Command injection in Dell ThinOS 10
- Dell ThinOS 10
- Command injection
- CVSS 8.7 High
ICEcoder through 8.1 OS Command Injection via lib/properties.php
- ICEcoder
- Command injection
- CVSS 8.5 High
Renovate before 44.14.7 Command Injection via distributionType
- renovate
- mend renovate-ce
- Command injection
- CVSS 7.3 High
Renovate before 44.14.7 Command Injection via Mix organization
- renovate
- mend renovate-ce
- Command injection
- CVSS 8.5 High
Renovate before 44.14.7 Command Injection via gradle-wrapper
- renovate
- mend renovate-ce
- Command injection
- CVSS 7.3 High
Renovate before 44.14.7 Command Injection via depName
- renovate
- mend renovate-ce
- Command injection
- CVSS 7.2 High
GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection
- GeoVision Inc. GV-LPCLPC2011/2211
- Command injection
- CVSS 8.8 High
GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection
- GeoVision Inc. GV-LPCLPC2011/2211
- Command injection
- CVSS 7.2 High
GV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command Injection
- GeoVision Inc. GV-LPCLPC2011/2211
- Command injection