CWE-77
CVEs classified under CWE-77, newest first.
562 CVEsRSS
CVE-2025-59738Critical· 9.8Operating system command injection vulnerability in AndSoft's e-TMS v25.03
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assign…
CVE-2025-59737Critical· 9.8Operating system command injection vulnerability in AndSoft's e-TMS v25.03
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assign…
CVE-2025-59736Critical· 9.8Operating system command injection vulnerability in AndSoft's e-TMS v25.03
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assign…
CVE-2025-59735Critical· 9.8Operating system command injection vulnerability in AndSoft's e-TMS v25.03
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assign…
CVE-2025-59741Critical· 9.8Operating system command injection vulnerability in AndSoft's e-TMS v25.03
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assign…
CVE-2025-11141Medium· 4.7A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919
A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.php?a=list. Performing manipulation of the argument city results in os command …
CVE-2025-11138Medium· 6.3A vulnerability was found in mirweiye wenkucms up to 3.4
A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has b…
CVE-2025-11100Medium· 6.3A vulnerability was identified in D-Link DIR-823X 250416
A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit …
CVE-2025-11099Medium· 6.3A vulnerability was determined in D-Link DIR-823X 250416
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiat…
CVE-2025-11097Medium· 6.3A vulnerability has been found in D-Link DIR-823X 250416
A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remo…
CVE-2025-11096Medium· 6.3A flaw has been found in D-Link DIR-823X 250416
A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed…
CVE-2025-11092Medium· 6.3A weakness has been identified in D-Link DIR-823X 250416
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initi…
CVE-2025-11121Medium· 6.3A security vulnerability has been detected in Tenda AC18 15.03.05.19
A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to command injection. The attack can be initi…
CVE-2025-11098Medium· 6.3A vulnerability was found in D-Link DIR-823X 250416
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed …
CVE-2025-11095Medium· 6.3A vulnerability was detected in D-Link DIR-823X 250416
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation…
CVE-2025-11073Medium· 4.7A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019
A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the …
CVE-2025-59817High· 8.4This vulnerability allows attackers to execute arbitrary commands on the underlying system
This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its avail…
CVE-2025-10964Medium· 6.3A weakness has been identified in Wavlink NU516U1
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attac…
CVE-2025-10963Medium· 6.3A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch…
CVE-2025-10962Medium· 6.3A vulnerability was identified in Wavlink NU516U1 M16U1_V240425
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac_5g leads to command injection. It…
CVE-2025-10961Medium· 5.5A vulnerability was determined in Wavlink NU516U1 M16U1_V240425
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to…
CVE-2025-10960Medium· 6.3A vulnerability was found in Wavlink NU516U1 M16U1_V240425
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument delete_list results in…
CVE-2025-10959Medium· 6.3A vulnerability has been found in Wavlink NU516U1 M16U1_V240425
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be …
CVE-2025-10958Medium· 6.3A flaw has been found in Wavlink NU516U1 M16U1_V240425
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploi…
CVE-2025-59831High· 8.8git-commiters is a Node.js function module providing committers stats for their git repository
git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary …
CVE-2025-59834Critical· 9.8ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as pa…
CVE-2025-20334High· 8.8A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient…
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient…
CVE-2025-10814Medium· 6.3A vulnerability was determined in D-Link DIR-823X 240126/240802/250416
A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack…
CVE-2025-10634Medium· 6.3A weakness has been identified in D-Link DIR-823X 240126/240802/250416
A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument termin…
CVE-2025-10035Critical· 10.0CISA KEVPoCA deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.