Weaknesses of type CWE-78

4,575 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-8192MEDIUMWavlink NU516U1 adm.cgi wzdap os command injectionEPSS 6.5%CVE-2019-25065MEDIUMOpenNetAdmin os command injectionEPSS 6.5%CVE-2013-10060CRITICALNetgear Routers pppoe.cgi RCEEPSS 6.5%CVE-2026-8189MEDIUMWavlink NU516U1 adm.cgi wzdrepeater os command injectionEPSS 6.5%CVE-2024-33112HIGHD-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func.EPSS 6.5%CVE-2024-28892CRITICALAn OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary cEPSS 6.5%CVE-2017-14001—An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS commEPSS 6.4%CVE-2023-6319CRITICALCommand injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceEPSS 6.4%CVE-2024-4815MEDIUMRuijie RG-UAC detail.php os command injectionEPSS 6.4%CVE-2024-4813MEDIUMRuijie RG-UAC interface_commit.php os command injectionEPSS 6.4%CVE-2023-53941CRITICALEasyPHP Webserver 14.1 Remote Code ExecutionEPSS 6.4%CVE-2024-4814MEDIUMRuijie RG-UAC static_route_edit_commit.php os command injectionEPSS 6.4%CVE-2024-4816MEDIUMRuijie RG-UAC gre_add_commit.php os command injectionEPSS 6.4%CVE-2023-3607MEDIUMkodbox WebConsole Plug-In webconsole.php.txt Execute os command injectionEPSS 6.4%CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 6.4%CVE-2025-43979HIGHAn issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system coEPSS 6.3%CVE-2025-34095CRITICALMako Server v2.5 and v2.6 OS Command Injection via examples/save.lspEPSS 6.3%CVE-2024-29224CRITICALAn OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary coEPSS 6.3%CVE-2013-10061HIGHNetgear Routers setup.cgi RCEEPSS 6.3%CVE-2026-2944MEDIUMTosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injectionEPSS 6.2%