CWE-77 · Command and Code Injection
Command Injection
3,181CVEs
33exploited
38with a public check
241likely (EPSS 10%+)
SortMost likely exploited
3,181 CVEs with CWE-77 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-3400In CISA KEVExploitedGlobalProtect - OS Command InjectionPalo Alto Networks · PAN-OS · CVSS 10 · 2024-04-12 | 10.0 | 100% | 2024-04-12 |
| CVE-2024-21887In CISA KEVExploitedIvanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command InjectionIvanti · ICS · CVSS 9.1 · 2024-01-12 | 9.1 | 100% | 2024-01-12 |
| CVE-2023-1671In CISA KEVExploitedSophos Web Appliance - Remote Code ExecutionSophos · Sophos Web Appliance · CVSS 9.8 · 2023-04-04 | 9.8 | 100% | 2023-04-04 |
| CVE-2023-1389In CISA KEVExploitedTP-Link Archer AX21 (AX1800) - Unauthenticated Command InjectionTP-Link · TP-Link Archer AX21 (AX1800) · CVSS 8.8 · 2023-03-15 | 8.8 | 100% | 2023-03-15 |
| CVE-2012-1823In CISA KEVExploitedPHP CGI v5.3.12/5.4.2 Remote Code ExecutionPHP · PHP · CVSS 9.8 · 2012-05-11 | 9.8 | 100% | 2012-05-11 |
| CVE-2024-3273In CISA KEVExploitedD-Link Network Attached Storage - Command Injection and Backdoor AccountD-Link · DNS-320L · CVSS 7.3 · 2024-04-04 | 7.3 | 100% | 2024-04-04 |
| CVE-2025-10035In CISA KEVExploitedGoAnywhere - Authentication BypassFortra · GoAnywhere MFT · CVSS 10 · 2025-09-18 | 10.0 | 100% | 2025-09-18 |
| CVE-2026-8037In CISA KEVExploitedProgress ADC LoadMaster - Command InjectionProgress Software · LoadMaster · CVSS 9.6 · 2026-06-04 | 9.6 | 100% | 2026-06-04 |
| CVE-2016-1555In CISA KEVExploitedNETGEAR WNAP320 Access Point Firmware - Remote Command InjectionNETGEAR · Wireless Access Point (WAP) Devices · CVSS 9.8 · 2017-04-21 | 9.8 | 98% | 2017-04-21 |
| CVE-2023-20887In CISA KEVExploitedVMware VRealize Network Insight - Remote Code ExecutionVMware · Aria Operations for Networks (Formerly vRealize Network Insight) · CVSS 9.8 · 2023-06-07 | 9.8 | 98% | 2023-06-07 |
| CVE-2007-3010In CISA KEVExploitedAlcatel-Lucent OmniPCX - Remote Command ExecutionAlcatel · OmniPCX Enterprise · CVSS 9.8 · 2007-09-18 | 9.8 | 97% | 2007-09-18 |
| CVE-2015-2051In CISA KEVExploitedThe D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP…D-Link · DIR-645 Router · CVSS 8.8 · 2015-02-23 | 8.8 | 97% | 2015-02-23 |
| CVE-2016-3081In CISA KEVExploitedApache S2-032 Struts - Remote Code ExecutionApache · Struts · CVSS 8.1 · 2016-04-26 | 8.1 | 97% | 2016-04-26 |
| CVE-2024-55956In CISA KEVExploitedCleo Harmony < 5.8.0.24 - File Upload VulnerabilityCleo · Multiple Products · CVSS 9.8 · 2024-12-13 | 9.8 | 94% | 2024-12-13 |
| CVE-2025-4008In CISA KEVExploitedMeteoBridge <= 6.1 - Remote Code ExecutionSmartbedded · MeteoBridge · CVSS 8.7 · 2025-05-21 | 8.7 | 93% | 2025-05-21 |
| CVE-2025-29635In CISA KEVExploitedD-Link DIR-823X set_prohibiting - Command InjectionD-Link · DIR-823X · CVSS 7.2 · 2025-03-25 | 7.2 | 88% | 2025-03-25 |
| CVE-2024-12356In CISA KEVExploitedCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)BeyondTrust · Remote Support · CVSS 9.8 · 2024-12-17 | 9.8 | 87% | 2024-12-17 |
| CVE-2005-2773In CISA KEVExploitedHP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl,…Hewlett Packard (HP) · OpenView Network Node Manager · CVSS 9.8 · 2005-09-02 | 9.8 | 74% | 2005-09-02 |
| CVE-2016-20017In CISA KEVExploitedD-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.D-Link · DSL-2750B Devices · CVSS 9.8 · 2022-10-19 | 9.8 | 66% | 2022-10-19 |
| CVE-2024-9380In CISA KEVExploitedAn OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote cod…Ivanti · CSA (Cloud Services Appliance) · CVSS 7.2 · 2024-10-08 | 7.2 | 58% | 2024-10-08 |
| CVE-2023-20118In CISA KEVExploitedA vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote at…Cisco · Cisco Small Business RV Series Router Firmware · CVSS 6.5 · 2023-04-05 | 6.5 | 54% | 2023-04-05 |
| CVE-2020-25079In CISA KEVExploitedAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.D-Link · DCS-2530L and DCS-2670L Devices · CVSS 8.8 · 2020-09-02 | 8.8 | 54% | 2020-09-02 |
| CVE-2019-0541In CISA KEVExploitedA remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Mi…Microsoft · Microsoft Office · CVSS 8.8 · 2019-01-08 | 8.8 | 53% | 2019-01-08 |
| CVE-2023-33538In CISA KEVExploitedTP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .TP-Link · Multiple Routers · CVSS 8.8 · 2023-06-07 | 8.8 | 42% | 2023-06-07 |
| CVE-2010-5330In CISA KEVExploitedOn certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell me…Ubiquiti · AirOS · CVSS 9.8 · 2019-06-11 | 9.8 | 40% | 2019-06-11 |
| CVE-2017-6327In CISA KEVExploitedThe Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execu…Symantec Corporation · Messaging Gateway · CVSS 8.8 · 2017-08-11 | 8.8 | 36% | 2017-08-11 |
| CVE-2021-22899In CISA KEVExploitedA command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profi…Ivanti · Pulse Connect Secure · CVSS 8.8 · 2021-05-27 | 8.8 | 23% | 2021-05-27 |
| CVE-2016-6367In CISA KEVExploitedCisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka B…Cisco · Adaptive Security Appliance (ASA) · CVSS 7.8 · 2016-08-18 | 7.8 | 23% | 2016-08-18 |
| CVE-2026-22719In CISA KEVExploitedVMware Aria Operations command injection vulnerabilityVMware · VMware Aria Operations · CVSS 8.1 · 2026-02-25 | 8.1 | 18% | 2026-02-25 |
| CVE-2010-4345In CISA KEVExploitedExim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that con…Exim · Exim · CVSS 7.8 · 2010-12-14 | 7.8 | 18% | 2010-12-14 |
| CVE-2022-40765In CISA KEVExploitedA vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a…Mitel · MiVoice Connect · CVSS 6.8 · 2022-11-22 | 6.8 | 11% | 2022-11-22 |
| CVE-2026-96951In CISA KEVExploitedWindows Shell Security Feature Bypass VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 8.8 · 2026-10-13 | 8.8 | 9.8% | 2026-10-13 |
| CVE-2025-59689In CISA KEVExploitedLibraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been…Libraesva · Email Security Gateway · CVSS 6.1 · 2025-09-19 | 6.1 | 2.0% | 2025-09-19 |
| CVE-2023-37679CheckNextGen Mirth Connect - Remote Code ExecutionNextgen · Mirth Connect · 2023-08-03 | – | 99% | 2023-08-03 |
| CVE-2023-34960CheckChamilo Command InjectionChamilo · Chamilo · 2023-08-01 | – | 99% | 2023-08-01 |
| CVE-2023-23333CheckSolarView Compact 6.00 - OS Command InjectionContec · Solarview Compact Firmware · CVSS 9.8 · 2023-02-06 | 9.8 | 99% | 2023-02-06 |
| CVE-2022-39986CheckRaspAP 2.8.7 - Unauthenticated Command InjectionRaspap · Raspap · 2023-08-01 | – | 99% | 2023-08-01 |
| CVE-2024-29895CheckCacti cmd_realtime.php - Command InjectionCacti · cacti · CVSS 10 · 2024-05-13 | 10.0 | 99% | 2024-05-13 |
| CVE-2023-29084CheckManageEngine ADManager Plus - Command InjectionZohocorp · Manageengine Admanager Plus · CVSS 7.2 · 2023-04-13 | 7.2 | 98% | 2023-04-13 |
| CVE-2016-10108CheckWestern Digital MyCloud NAS - Command InjectionWestern Digital · Mycloud Nas · 2017-01-03 | – | 98% | 2017-01-03 |
| CVE-2022-36553CheckHytec Inter HWL-2511-SS - Remote Command ExecutionHytec · Hwl-2511-Ss Firmware · 2022-08-29 | – | 97% | 2022-08-29 |
| CVE-2023-30258CheckMagnusBilling - Remote Code ExecutionMagnussolution · Magnusbilling · CVSS 9.8 · 2023-06-23 | 9.8 | 94% | 2023-06-23 |
| CVE-2022-40022CheckSymmetricom SyncServer Unauthenticated - Remote Command ExecutionMicrochip · Syncserver S650 Firmware · CVSS 9.8 · 2023-02-13 | 9.8 | 92% | 2023-02-13 |
| CVE-2024-11320CheckPandora v7.0NG.777.3 - Remote Code ExecutionPandora FMS · Pandora FMS · CVSS 6.9 · 2024-11-21 | 6.9 | 91% | 2024-11-21 |
| CVE-2023-20889CheckVMware Aria Operations for Networks - Code Injection Information Disclosure VulnerabilityVmware · Aria Operations for Networks (Formerly vRealize Network Insight) · CVSS 7.5 · 2023-06-07 | 7.5 | 79% | 2023-06-07 |
| CVE-2022-41800CheckF5 BIG-IP Appliance Mode - Command InjectionF5 · BIG-IP · CVSS 8.7 · 2022-12-07 | 8.7 | 77% | 2022-12-07 |
| CVE-2025-4009CheckEvertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command InjectionEvertz · 3080ipx-10G · CVSS 9.3 · 2025-05-28 | 9.3 | 74% | 2025-05-28 |
| CVE-2024-22729CheckNetis MW5360 V1.0.1.3031 - Command InjectionNetis-Systems · Mw5360 Firmware · CVSS 9.8 · 2024-01-25 | 9.8 | 71% | 2024-01-25 |
| CVE-2020-13117CheckWavlink Multiple AP - Remote Command InjectionWavlink · Wn575a4 Firmware · 2021-02-09 | – | 69% | 2021-02-09 |
| CVE-2023-46574CheckTOTOLINK A3700R - Command InjectionTotolink · A3700r Firmware · 2023-10-24 | – | 65% | 2023-10-24 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.