Weaknesses of type CWE-78

4,576 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2022-4221CRITICALOS command injection in ASUS M25 NASEPSS 4.9%CVE-2021-21016CRITICALMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 4.9%CVE-2024-0293MEDIUMTotolink LR1200GB cstecgi.cgi setUploadSetting os command injectionEPSS 4.8%CVE-2025-7097CRITICALComodo Internet Security Premium Manifest File cis_update_x64.xml os command injectionEPSS 4.8%CVE-2025-9727MEDIUMD-Link DIR-816L soap.cgi soapcgi_main os command injectionEPSS 4.8%CVE-2022-45915HIGHILIAS before 7.16 allows OS Command Injection.EPSS 4.8%CVE-2023-0935MEDIUMDolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injectionEPSS 4.8%CVE-2025-7382HIGHA command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achievEPSS 4.8%CVE-2023-2574HIGHAuthenticated Command InjectionEPSS 4.8%CVE-2023-2573HIGHAuthenticated Command InjectionEPSS 4.8%CVE-2025-50201CRITICALWeGIA OS Command Injection in debug_info.php parameter 'branch'EPSS 4.7%CVE-2026-15511CRITICALComfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injectionEPSS 4.7%CVE-2026-2152HIGHD-Link DIR-615 Web Configuration adv_routing.php os command injectionEPSS 4.7%CVE-2021-40411CRITICALAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] thEPSS 4.7%CVE-2025-6899MEDIUMD-Link DI-7300G+/DI-8200G msp_info.htm os command injectionEPSS 4.7%CVE-2013-10039HIGHGestioIP 3.0 ip_checkhost.cgi RCEEPSS 4.7%CVE-2023-6318CRITICALCommand injection in the processAnalyticsReport method from the com.webos.service.cloudupload serviceEPSS 4.7%CVE-2022-45639HIGHOS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m EPSS 4.7%CVE-2026-3485CRITICALD-Link DIR-868L SSDP Service sub_1BF84 os command injectionEPSS 4.7%CVE-2014-125118CRITICALeScan 5.5-2 Web Management Console Command InjectionEPSS 4.7%