Weaknesses of type CWE-78

5,064 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-9814CRITICALAn OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2EPSS 1.6%CVE-2022-22684HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in SynEPSS 1.6%CVE-2025-32107HIGHOS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vEPSS 1.6%CVE-2023-23362HIGHQTS, QuTS hero, QuTScloudEPSS 1.6%CVE-2026-9155HIGHOS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.EPSS 1.6%CVE-2026-19679HIGHImproper Input ValidationEPSS 1.6%CVE-2023-6201HIGHCommand Injection in Univera Panorama FrameworkEPSS 1.6%CVE-2026-104584CRITICALreNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via tEPSS 1.6%CVE-2025-63916HIGHMyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properlyEPSS 1.6%CVE-2026-40855CRITICALCommand Injection in T-Mobile 5G Box IDU router via ping functionalityEPSS 1.6%CVE-2024-38644HIGHNotes Station 3EPSS 1.6%CVE-2026-2035MEDIUMDeciso OPNsense diag_backup.php filename Command Injection Remote Code Execution VulnerabilityEPSS 1.6%CVE-2026-67438MEDIUMOliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckEPSS 1.6%CVE-2024-47919CRITICALTiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')EPSS 1.6%CVE-2023-44291HIGH Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentEPSS 1.6%CVE-2022-37880HIGHVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onEPSS 1.6%CVE-2022-37882HIGHVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onEPSS 1.6%CVE-2026-16466HIGHDataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareEPSS 1.6%CVE-2023-22919HIGHThe post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated aEPSS 1.6%CVE-2022-48581HIGHA command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input aEPSS 1.6%