Weaknesses of type CWE-78

4,991 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2021-27249HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-FiEPSS 5.1%CVE-2026-5351MEDIUMTrendnet TEW-657BRM setup.cgi add_wps_client os command injectionEPSS 5.1%CVE-2026-5844HIGHD-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injectionEPSS 5.1%CVE-2026-1505HIGHD-Link DIR-615 URL Filter set_temp_nodes.php os command injectionEPSS 5.1%CVE-2026-19599CRITICALRemote Code Execution vulnerabilityEPSS 5.1%CVE-2026-112195MEDIUMFusionPBX Dialplan Editor dialplan.php os command injectionEPSS 5.0%CVE-2024-4255MEDIUMRuijie RG-UAC gre_edit_commit.php os command injectionEPSS 5.0%CVE-2026-2129HIGHD-Link DIR-823X set_ac_status os command injectionEPSS 5.0%CVE-2026-2143HIGHD-Link DIR-823X DDNS Service set_ddns os command injectionEPSS 5.0%CVE-2025-10359MEDIUMWavlink WL-WN578W2 wireless.cgi sub_404DBC os command injectionEPSS 5.0%CVE-2026-8263MEDIUMTenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injectionEPSS 5.0%CVE-2020-7350MEDIUMMetasploit Framework Plugin Libnotify Command InjectionEPSS 5.0%CVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2026-41922CRITICALWDR201A WiFi Extender OS Command Injection via wireless.cgiEPSS 5.0%CVE-2026-4558HIGHLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injectionEPSS 5.0%CVE-2020-10886HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1EPSS 5.0%CVE-2025-7788MEDIUMXuxueli xxl-job SampleXxlJob.java commandJobHandler os command injectionEPSS 4.9%CVE-2019-5141HIGHAn exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially EPSS 4.9%CVE-2017-14429CRITICALThe DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) deviceEPSS 4.9%CVE-2024-0292MEDIUMTotolink LR1200GB cstecgi.cgi setOpModeCfg os command injectionEPSS 4.9%