Vulnerability that allows an attacker to execute arbitrary operating-system commands on the host machine. It occurs when user input is incorporated directly into a shell command without proper sanitation or validation.
The attacker injects additional commands (often separated by ;, &&, |, etc.) which the application then runs, potentially giving them control over the system.
Examples
WordPress Plugin Plainview Activity Monitor 20161228
Allows attackers to inject their command in the ip value, by simply adding | COMMAND... after the ip value.