Weaknesses of type CWE-78

5,015 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2023-6018CRITICALMLflow Arbitrary File WriteEPSS 47.9%CVE-2024-51568CRITICALCyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There EPSS 47.7%CVE-2021-40407CRITICALAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] orEPSS 47.6%KEVCVE-2025-54782CRITICAL@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS DevelopersEPSS 47.2%CVE-2019-1636HIGHCisco Webex Teams URI Handler Insecure Library Loading VulnerabilityEPSS 46.9%CVE-2025-7083MEDIUMBelkin F9K1122 webs mp os command injectionEPSS 46.3%CVE-2024-28254HIGHSpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadataEPSS 45.7%CVE-2019-5127CRITICALA command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. ExploitableEPSS 45.3%CVE-1999-0043CRITICALCommand execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and "rmgroup" control messages, and others.EPSS 44.6%CVE-2025-64155CRITICALAn improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, ForEPSS 43.9%CVE-2023-25826CRITICALRemote Code Execution in OpenTSDBEPSS 43.0%CVE-2024-53375HIGHAn Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_EPSS 42.1%CVE-2023-4473CRITICALA command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(EPSS 41.3%CVE-2025-9377HIGHAuthenticated RCE via Parental Control command injectionEPSS 41.3%KEVCVE-2020-10882HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: EPSS 41.1%CVE-2022-46476CRITICALD-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.EPSS 41.1%CVE-2023-2564CRITICALOS Command Injection in sbs20/scanservjsEPSS 40.5%CVE-2021-20044—A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS systemEPSS 40.1%CVE-2023-35138CRITICALA command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAEPSS 40.0%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%