OS Command Injection. It doesn't get much more severe than that regarding web application/API vulnerabilities. Still, these issues keep coming up in security devices. https://isc.sans.edu/j/osinjection