Weaknesses of type CWE-78

4,668 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2021-34722MEDIUMCisco IOS XR Software Command Injection VulnerabilitiesEPSS 0.3%CVE-2021-34721MEDIUMCisco IOS XR Software Command Injection VulnerabilitiesEPSS 0.3%CVE-2026-102828CRITICALsimple-git unsafe-operation guard does not block trailer command configurationEPSS 0.3%CVE-2026-102829CRITICALsimple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionEPSS 0.3%CVE-2021-21527MEDIUMDell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerabiEPSS 0.3%CVE-2026-14275MEDIUMIBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesEPSS 0.3%CVE-2021-21550MEDIUMDell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulneEPSS 0.3%CVE-2026-14276MEDIUMIBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesEPSS 0.3%CVE-2026-34982HIGHVim modeline bypass via various options affects Vim < 9.2.0276EPSS 0.3%CVE-2022-1356HIGHCambium Networks cnMaestro use of Potentially Dangerous FunctionEPSS 0.3%CVE-2020-25859—The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validatinEPSS 0.3%CVE-2024-37678MEDIUMCross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker tEPSS 0.3%CVE-2025-33234HIGHNVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead tEPSS 0.3%CVE-2026-32948MEDIUMsbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on WindowsEPSS 0.3%CVE-2026-55582HIGHmcp-shell: Secure Mode Allowlist Bypass via Git Shell AliasEPSS 0.3%CVE-2026-84967MEDIUMArbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminalEPSS 0.3%CVE-2025-43858CRITICALYoutubeDLSharp allows command injection on windows system due to non sanitized argumentsEPSS 0.3%CVE-2025-47780MEDIUMcli_permissions.conf: deny option does not work for disallowing shell commandsEPSS 0.3%CVE-2025-41225HIGHVMware vCenter Server authenticated command-execution vulnerabilityEPSS 0.3%CVE-2026-43991HIGHJunoClaw: plugin-shell shell-injection bypass via substring blocklistEPSS 0.3%