Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-15513MEDIUMWavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injectionEPSS 1.8%CVE-2026-90621MEDIUMipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injectionEPSS 1.8%CVE-2026-79623MEDIUMFishCodeTech Muteki Default Local Worker Backend settings.json os command injectionEPSS 1.8%CVE-2026-15033MEDIUMchristopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injectionEPSS 1.8%CVE-2026-18590MEDIUMWavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injectionEPSS 1.8%CVE-2026-91853MEDIUMTOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injectionEPSS 1.8%CVE-2021-28804—Command Injection Vulnerabilities in QTS and QuTS heroEPSS 1.8%CVE-2021-28802—Command Injection Vulnerabilities in QTS and QuTS heroEPSS 1.8%CVE-2026-5059CRITICALaws-mcp-server AWS CLI Command Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-57542HIGHLinksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn.EPSS 1.8%CVE-2021-1538MEDIUMCisco Common Services Platform Collector Command Injection VulnerabilityEPSS 1.8%CVE-2026-110541HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 1.8%CVE-2022-43971HIGHArbitrary code execution in Linksys WUMC710EPSS 1.8%CVE-2026-24517HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 1.8%CVE-2026-73697HIGHControl Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editorEPSS 1.8%CVE-2023-30621CRITICALOS command injection in GipsyEPSS 1.8%CVE-2021-47816MEDIUMThecus N4800Eco Nas Server Control Panel - Command InjectionEPSS 1.8%CVE-2023-40582CRITICALCommand Injection Vulnerability in find-execEPSS 1.8%CVE-2022-4643MEDIUMdocconv pdf_ocr.go ConvertPDFImages os command injectionEPSS 1.8%CVE-2026-105407HIGHOS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5EPSS 1.8%