CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Parent: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

393 vulnerabilities with CWE-88
CVE-2025-52459 MEDIUM
Advantech iView - Command Injection
CVSS 6.5
CVE-2025-53542 HIGH
Kubernetes Headlamp - Command Injection
CVSS 7.7
CVE-2025-46835 HIGH
Git GUI <2.43.7-2.50.1 - Info Disclosure
CVSS 8.5
CVE-2025-48385 HIGH
Git Bundle URI - Protocol Injection Arbitrary Code Execution
CVE-2025-49520 HIGH
Red Hat Ansible Automation Platform 2.5 for RHEL 8/9 - Authenticated Command Injection via Git URL Argument Injection
CVSS 8.8
CVE-2025-52480 CRITICAL
julialang/registrator < 1.9.5 - Remote Code Execution via Argument Injection in gettreesha()
CVSS 9.8
CVE-2025-3460 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via set_tx_pow Script
CVSS 7.7
CVE-2025-3459 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via transmit_file Script
CVSS 7.7
CVE-2025-35010 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 - Authenticated Command Injection via AT+MNPINGTM
CVSS 7.1
CVE-2025-35009 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 Firmware - Authenticated Command Injection via AT+MNNETSP
CVSS 7.1
CVE-2025-35008 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 Firmware < 1.2.0-r1132 - Authenticated Command Injection via AT+MMNAME
CVSS 7.1
CVE-2025-35007 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 Firmware - Authenticated Command Injection via AT+MFRULE
CVSS 7.1
CVE-2025-35006 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 Firmware - Authenticated Command Injection via AT+MFPORTFWD
CVSS 7.1
CVE-2025-35005 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 Firmware - Authenticated Command Injection via AT+MFMAC
CVSS 7.1
CVE-2025-35004 HIGH
Microhard BulletLTE-NA2 and IPn4Gii-NA2 Firmware < 1.2.0-r1132 - Authenticated Command Injection via AT+MFIP
CVSS 7.1
CVE-2025-32459 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via router_command.sh sync_time Argument
CVSS 7.7
CVE-2025-32458 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via router_command.sh get_syslog_from_qtn Argument
CVSS 7.7
CVE-2025-32457 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via router_command.sh get_file_from_qtn Argument
CVSS 7.7
CVE-2025-32456 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via router_command.sh put_file_to_qtn Argument
CVSS 7.7
CVE-2025-32455 HIGH
onsemi Quantenna Wi-Fi Firmware - OS Command Injection via router_command.sh run_cmd Argument
CVSS 7.7
CVE-2025-49008 CRITICAL
Atheos < 6.0.4 - OS Command Injection via Execute.php Argument Injection
CVE-2025-3945 HIGH
Tridium Niagara <4.14.2-4.15.1-4.10.11 - Command Injection
CVSS 7.2
CVE-2025-1712 HIGH
Checkmk <2.4.0p1,<2.3.0p32,<2.2.0p42,2.1.0 - Command Injection
CVSS 8.8
CVE-2025-31499 HIGH
jellyfin < 10.10.7 - Authenticated Argument Injection in FFmpeg via Stream Endpoints
CVSS 8.8
CVE-2025-32931 CRITICAL
DevDojo Voyager <1.8.0 - Command Injection
CVSS 9.1
Details
Vulnerabilities 393
Links
MITRE CWE Entry Search this CWE With Exploits