Export limit exceeded: 410577 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8545 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-45104 1 Dell 3 Evasa Provider Virtual Appliance, Solutions Enabler Virtual Appliance, Unisphere For Powermax Virtual Appliance 2025-03-24 8.8 High
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to execute arbitrary commands on the underlying system.
CVE-2023-0776 1 Baicells 8 Neutrino 430, Neutrino 430 Firmware, Nova430e and 5 more 2025-03-24 8.1 High
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 
CVE-2023-0127 1 Dlink 2 Dwl-2600ap, Dwl-2600ap Firmware 2025-03-24 7.8 High
A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
CVE-2023-0789 1 Phpmyfaq 1 Phpmyfaq 2025-03-21 8.1 High
Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
CVE-2022-40022 1 Microchip 2 Syncserver S650, Syncserver S650 Firmware 2025-03-21 9.8 Critical
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
CVE-2023-24161 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-03-20 9.8 Critical
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
CVE-2023-24160 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-03-20 9.8 Critical
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-22996 1 Linux 1 Linux Kernel 2025-03-20 5.5 Medium
In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
CVE-2023-24159 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-03-20 9.8 Critical
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.
CVE-2023-22935 1 Splunk 2 Splunk, Splunk Cloud Platform 2025-03-20 8.1 High
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.
CVE-2019-1000018 4 Canonical, Debian, Fedoraproject and 1 more 4 Ubuntu Linux, Debian Linux, Fedora and 1 more 2025-03-19 7.8 High
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
CVE-2022-28656 2 Apport Project, Canonical 2 Apport, Ubuntu Linux 2025-03-19 5.5 Medium
is_closing_session() allows users to consume RAM in the Apport process
CVE-2023-40396 1 Apple 7 Ios, Ipad Os, Ipados and 4 more 2025-03-19 7.8 High
The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to execute arbitrary code with kernel privileges.
CVE-2024-35518 1 Netgear 2 Ex6120, Ex6120 Firmware 2025-03-19 8.4 High
Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.
CVE-2024-44083 1 Hex-rays 1 Ida Pro 2025-03-18 7.5 High
ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where the actual entry point will be invoked. NOTE: in many use cases, this is an inconvenience but not a security issue.
CVE-2023-24238 1 Totolink 2 A7100ru, A7100ru Firmware 2025-03-18 9.8 Critical
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
CVE-2023-24236 1 Totolink 2 A7100ru, A7100ru Firmware 2025-03-18 9.8 Critical
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
CVE-2022-40021 1 Qvidium 2 Amino A140, Amino A140 Firmware 2025-03-18 9.8 Critical
QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.
CVE-2023-24785 1 Peazip Project 1 Peazip 2025-03-18 5.5 Medium
An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature.
CVE-2022-48339 2 Gnu, Redhat 3 Emacs, Enterprise Linux, Rhel Eus 2025-03-18 7.8 High
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.