Weaknesses of type CWE-78

5,018 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-11285MEDIUMsamanhappy MCPHub serverController.ts os command injectionEPSS 7.9%CVE-2026-8228MEDIUMWavlink NU516U1 wireless.cgi advance os command injectionEPSS 7.8%CVE-2026-8189MEDIUMWavlink NU516U1 adm.cgi wzdrepeater os command injectionEPSS 7.8%CVE-2024-2897MEDIUMTenda AC7 WriteFacMac formWriteFacMac os command injectionEPSS 7.8%CVE-2025-10328MEDIUMMiczFlor RPi-Jukebox-RFID playsinglefile.php os command injectionEPSS 7.8%CVE-2023-5494MEDIUMByzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform download.php os command injectionEPSS 7.7%CVE-2025-1616MEDIUMFiberHome AN5506-01A ONU GPON Diagnosis os command injectionEPSS 7.7%CVE-2025-43989MEDIUMThe /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesettiEPSS 7.7%CVE-2025-9387MEDIUMDCN DCME-720 Web Management Backend ip_block.php os command injectionEPSS 7.7%CVE-2025-10680HIGHOpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variableEPSS 7.7%CVE-2021-32849HIGHArbitrary command execution in GerapyEPSS 7.6%CVE-2024-6187MEDIUMRuijie RG-UAC sub_commit.php os command injectionEPSS 7.6%CVE-2025-50475CRITICALAn OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute EPSS 7.6%CVE-2025-34513CRITICALIlevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command InjectionEPSS 7.6%CVE-2024-4506MEDIUMRuijie RG-UAC ip_addr_edit_commit.php os command injectionEPSS 7.6%CVE-2026-48030CRITICALPheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)EPSS 7.5%CVE-2026-6204HIGHLibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config EPSS 7.5%CVE-2026-79756HIGHNuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platformEPSS 7.5%CVE-2026-56274HIGHFlowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessEPSS 7.5%CVE-2025-34043CRITICALVacron NVR Remote Command ExecutionEPSS 7.5%