Weaknesses of type CWE-78

5,064 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-9434CRITICALTotolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injectionEPSS 1.7%CVE-2023-48664HIGH Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could EPSS 1.7%CVE-2026-63304CRITICALAVideo through 29.0 OS Command Injection via listFFmpegProcessesEPSS 1.7%CVE-2026-9385CRITICALTotolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injectionEPSS 1.7%CVE-2026-9432CRITICALTotolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injectionEPSS 1.7%CVE-2026-9387CRITICALTotolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injectionEPSS 1.7%CVE-2026-9405CRITICALTotolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injectionEPSS 1.7%CVE-2026-9406CRITICALTotolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injectionEPSS 1.7%CVE-2023-48663HIGH Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could EPSS 1.7%CVE-2026-9386CRITICALTotolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injectionEPSS 1.7%CVE-2023-48665HIGH Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could EPSS 1.7%CVE-2026-9433CRITICALTotolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injectionEPSS 1.7%CVE-2025-15060CRITICALclaude-hovercraft executeClaudeCode Command Injection Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-29185CRITICALFreeScout OS Command Injection vulnerabilityEPSS 1.7%CVE-2024-27772HIGHUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-78: 'OS Command Injection'EPSS 1.7%CVE-2024-24325CRITICALTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParenEPSS 1.7%CVE-2024-24332CRITICALTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilteEPSS 1.7%CVE-2021-33532HIGHWEIDMUELLER: WLAN devices affected by OS Command Injection vulnerabilityEPSS 1.7%CVE-2021-33533HIGHWEIDMUELLER: WLAN devices affected by OS Command Injection vulnerabilityEPSS 1.7%CVE-2021-33530HIGHWEIDMUELLER: WLAN devices affected by OS Command Injection vulnerabilityEPSS 1.7%