CWE-78
CVEs classified under CWE-78, newest first.
1423 CVEsRSS
CVE-2026-71921Critical· 9.8Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote atta…
CVE-2026-71919High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remot…
CVE-2026-71918High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command e…
CVE-2026-71917High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger thi…
CVE-2026-71916High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quo…
CVE-2026-71915High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remo…
CVE-2026-71914Critical· 9.8Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote …
CVE-2026-71913High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A rem…
CVE-2026-71910High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker c…
CVE-2026-71909High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this v…
CVE-2026-71908High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command exe…
CVE-2026-71907High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger …
CVE-2026-71906High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can t…
CVE-2026-71905High· 7.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function
Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A…
CVE-2026-71943High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacke…
CVE-2026-71931High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker…
CVE-2026-71930High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker …
CVE-2026-71929High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attac…
CVE-2026-71928High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attack…
CVE-2026-71927High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacke…
CVE-2026-71926High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A …
CVE-2026-71925High· 7.2Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacke…
CVE-2026-59561High· 7.8Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability
Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when …
CVE-2026-78211Critical· 9.84MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability
4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrar…
CVE-2026-78177Medium· 4.5A vulnerability was found in TanStack devtools-vite 0.7.0
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manip…
CVE-2026-78430Medium· 5.3A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1
A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os…
CVE-2026-78541NoneA stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, …
CVE-2026-16348NonePoCAn authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. …
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. …
CVE-2026-76055NoneImproper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating s…
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating s…
CVE-2026-52490Critical· 9.8⚖ disputedAn issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c