Weaknesses of type CWE-78

5,018 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-11665MEDIUMD-Link DAP-2695 Firmware Update rgbin fwupdater_main os command injectionEPSS 6.8%CVE-2024-41473HIGHTenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMacEPSS 6.7%CVE-2023-24229HIGHDrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system cEPSS 6.7%CVE-2025-9244MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaticRoute os command injectionEPSS 6.7%CVE-2024-4504MEDIUMRuijie RG-UAC commit.php os command injectionEPSS 6.7%CVE-2025-65202HIGHTRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP EPSS 6.7%CVE-2017-10955HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0. AutheEPSS 6.7%CVE-2026-3101MEDIUMIntelbras TIP 635G Ping os command injectionEPSS 6.6%CVE-2019-5142HIGHAn exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A speciallyEPSS 6.6%CVE-2026-2142HIGHD-Link DIR-823X set_qos sub_420688 os command injectionEPSS 6.6%CVE-2019-25065MEDIUMOpenNetAdmin os command injectionEPSS 6.6%CVE-2025-34082CRITICALIGEL OS Secure Terminal and Secure Shadow Remote Code ExecutionEPSS 6.6%CVE-2026-111226HIGHNetgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.phpEPSS 6.5%CVE-2024-33112HIGHD-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func.EPSS 6.5%CVE-2024-28892CRITICALAn OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary cEPSS 6.5%CVE-2017-14001—An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS commEPSS 6.4%CVE-2023-6319CRITICALCommand injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceEPSS 6.4%CVE-2024-4815MEDIUMRuijie RG-UAC detail.php os command injectionEPSS 6.4%CVE-2024-4813MEDIUMRuijie RG-UAC interface_commit.php os command injectionEPSS 6.4%CVE-2023-53941CRITICALEasyPHP Webserver 14.1 Remote Code ExecutionEPSS 6.4%