Weaknesses of type CWE-78

5,064 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-45748CRITICALTermix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command InjectionEPSS 1.7%CVE-2026-25111HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 1.7%CVE-2026-25109HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 1.7%CVE-2024-23061CRITICALTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setSchedEPSS 1.7%CVE-2026-24695HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 1.7%CVE-2024-23059CRITICALTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnEPSS 1.7%CVE-2026-24689HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 1.7%CVE-2026-9717HIGHCWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized EPSS 1.7%CVE-2026-30312CRITICALDSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechaniEPSS 1.7%CVE-2026-30311CRITICALRidvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanEPSS 1.7%CVE-2026-58000HIGHluci-proto-openvpn - Command Injection via cl_meta Parameter in generateKeyEPSS 1.7%CVE-2025-56498MEDIUMAn OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp pEPSS 1.7%CVE-2022-42055MEDIUMMultiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroEPSS 1.7%CVE-2022-44567CRITICALA command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalEPSS 1.7%CVE-2025-14287HIGHCommand Injection in mlflow/mlflowEPSS 1.7%CVE-2026-61376HIGHELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerabiliEPSS 1.7%CVE-2026-50043HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110. If thiEPSS 1.7%CVE-2026-59764HIGHELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploEPSS 1.7%CVE-2026-49815HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 1.7%CVE-2025-6559CRITICALSapido Wireless Router - OS Command InjectionEPSS 1.7%