Weaknesses of type CWE-78

4,576 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2018-1167—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User inEPSS 4.7%CVE-2026-1505HIGHD-Link DIR-615 URL Filter set_temp_nodes.php os command injectionEPSS 4.7%CVE-2026-8271MEDIUMD-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injectionEPSS 4.6%CVE-2024-2707MEDIUMTenda AC10U WriteFacMac formWriteFacMac os command injectionEPSS 4.6%CVE-2026-2151HIGHD-Link DIR-615 DMZ Host Feature adv_firewall.php os command injectionEPSS 4.6%CVE-2026-2063MEDIUMD-Link DIR-823X Web Management set_ac_server os command injectionEPSS 4.6%CVE-2025-54404HIGHMultiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted networEPSS 4.6%CVE-2025-54403HIGHMultiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted networEPSS 4.6%CVE-2026-8263MEDIUMTenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injectionEPSS 4.6%CVE-2022-29472CRITICALAn OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One SEPSS 4.5%CVE-2026-8273MEDIUMD-Link DNS-320 system_mgr.cgi cgi_merge_user os command injectionEPSS 4.5%CVE-2025-2717MEDIUMD-Link DIR-823X HTTP POST Request diag_nslookup sub_41710C os command injectionEPSS 4.5%CVE-2026-5352MEDIUMTrendnet TEW-657BRM setup.cgi edit os command injectionEPSS 4.5%CVE-2022-1986CRITICALOS Command Injection in gogs/gogsEPSS 4.5%CVE-2026-2129HIGHD-Link DIR-823X set_ac_status os command injectionEPSS 4.5%CVE-2026-2143HIGHD-Link DIR-823X DDNS Service set_ddns os command injectionEPSS 4.5%CVE-2026-4585CRITICALTiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injectionEPSS 4.5%CVE-2025-34125CRITICALD-Link DSP-W110A1 Cookie Command InjectionEPSS 4.5%CVE-2021-30361—The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a commEPSS 4.5%CVE-2026-2061MEDIUMD-Link DIR-823X set_ipv6 sub_424D20 os command injectionEPSS 4.5%