Weaknesses of type CWE-78

4,576 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-22604CRITICALCacti has Authenticated RCE via multi-line SNMP responsesEPSS 5.4%CVE-2020-17406HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112EPSS 5.3%CVE-2025-30289HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 5.3%CVE-2025-35028CRITICALHexStrike AI MCP Server Command InjectionEPSS 5.3%CVE-2026-1506HIGHD-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injectionEPSS 5.3%CVE-2021-21884CRITICALAn OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specEPSS 5.3%CVE-2026-5354MEDIUMTrendnet TEW-657BRM setup.cgi vpn_connect os command injectionEPSS 5.2%CVE-2026-5353MEDIUMTrendnet TEW-657BRM setup.cgi ping_test os command injectionEPSS 5.2%CVE-2026-5355MEDIUMTrendnet TEW-657BRM setup.cgi vpn_drop os command injectionEPSS 5.2%CVE-2023-33617HIGHAn OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_EPSS 5.2%CVE-2025-9262MEDIUMwong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionEPSS 5.2%CVE-2023-4411MEDIUMTOTOLINK EX1200L setTracerouteCfg os command injectionEPSS 5.2%CVE-2024-12358MEDIUMWeiYe-Jing datax-web add os command injectionEPSS 5.2%CVE-2026-7608MEDIUMTRENDnet TEW-821DAP tools_diagnostic os command injectionEPSS 5.2%CVE-2026-2260HIGHD-Link DCS-931L setSysAdmin os command injectionEPSS 5.2%CVE-2023-30854HIGHWWBN AVideo vulnerable to OS Command InjectionEPSS 5.2%CVE-2019-5138CRITICALAn exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.EPSS 5.2%CVE-2024-3191CRITICALMailCleaner Email os command injectionEPSS 5.2%CVE-2026-79756HIGHNuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platformEPSS 5.1%CVE-2024-10919MEDIUMdidi Super-Jacoco triggerUnitCover os command injectionEPSS 5.1%