Weaknesses of type CWE-78

5,064 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-44098HIGHOS Command Injection in OCPP Agent via charge_box_idEPSS 1.7%CVE-2026-0781HIGHALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-0780HIGHALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-73767HIGHAuthenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line InterfaceEPSS 1.7%CVE-2025-26817CRITICALNetwrix Password Secure 9.2.0.32454 allows OS command injection.EPSS 1.7%CVE-2025-25067CRITICALmySCADA myPRO Manager OS Command InjectionEPSS 1.7%CVE-2024-48889HIGHAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager versionEPSS 1.7%CVE-2022-37924HIGHVulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theEPSS 1.7%CVE-2026-80151CRITICALLantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadEPSS 1.7%CVE-2026-80152CRITICALLantronix Autonomous Out-of-Band Devices OS Command Injection via set script scheduleEPSS 1.7%CVE-2022-34447HIGH PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability. An authenticated remote atEPSS 1.7%CVE-2026-72580CRITICALduhow xiaoai-patch - OS Command Injection in /mute and /unmute EndpointsEPSS 1.7%CVE-2024-3196MEDIUMMailCleaner SOAP Service dumpConfiguration os command injectionEPSS 1.7%CVE-2026-8500CRITICALWeb::Passwd versions through 0.03 for Perl is vulnerable to RCEEPSS 1.7%CVE-2023-25607HIGHAn improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 EPSS 1.7%CVE-2026-109108CRITICALWavlink WL-WN530BE1-A uploadVpn.cgi popen os command injectionEPSS 1.7%CVE-2026-120282CRITICALWAVLINK WN536AX6-A protocol.csp host_black os command injectionEPSS 1.7%CVE-2026-120228CRITICALWAVLINK WN553X1-B ioos Service sub_416D88 os command injectionEPSS 1.7%CVE-2024-31473CRITICALThere is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code executiEPSS 1.7%CVE-2025-45042CRITICALTenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function.EPSS 1.7%