Weaknesses of type CWE-78

4,566 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-66398CRITICALSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)EPSS 20.1%CVE-2025-3002MEDIUMDigital China DCME-520 mon_merge_stat_hist.php os command injectionEPSS 20.0%CVE-2025-10775MEDIUMWavlink WL-NU516U1 login.cgi sub_4012A0 os command injectionEPSS 20.0%CVE-2025-32821HIGHA vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell comEPSS 19.9%CVE-2023-51385MEDIUMIn ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is refereEPSS 19.8%CVE-2025-7081MEDIUMBelkin F9K1122 webs formSetWanStatic os command injectionEPSS 19.7%CVE-2025-6771HIGHOS command injection in Ivanti Endpoint ManagerEPSS 19.7%CVE-2025-14093MEDIUMEdimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injectionEPSS 19.6%CVE-2025-32778CRITICALWeb-Check allows command Injection via Unvalidated URL in Screenshot APIEPSS 19.6%CVE-2019-10891CRITICALAn issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checkingEPSS 19.4%CVE-2023-26315MEDIUMXiaomi router has a command injection vulnerability after authorizationEPSS 19.4%CVE-2017-14094—A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote commandEPSS 19.4%CVE-2025-50121CRITICALA CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause uEPSS 19.3%CVE-2025-67038CRITICALLantronix EDS5000, G520, and X300 OS Command InjectionEPSS 19.3%KEVCVE-2024-58274HIGHHikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /EPSS 19.1%CVE-2023-23368CRITICALQTS, QuTS hero, QuTScloudEPSS 18.8%CVE-2023-24261HIGHA vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST rEPSS 18.8%CVE-2026-25512CRITICALGroup-Office is vulnerable to RCE due to Command Injection via TNEF Attachment HandlerEPSS 18.5%CVE-2018-15716—NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handleEPSS 18.5%CVE-2025-60787HIGHMotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user iEPSS 18.5%