Weaknesses of type CWE-78

5,006 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-15511CRITICALComfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injectionEPSS 4.7%CVE-2026-6516CRITICALRemote Code ExecutionEPSS 4.7%CVE-2026-79689MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 4.7%CVE-2026-111216HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IPEPSS 4.7%CVE-2022-45639HIGHOS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m EPSS 4.7%CVE-2026-2120HIGHD-Link DIR-823X Configuration Parameter set_server_settings os command injectionEPSS 4.7%CVE-2026-2157HIGHD-Link DIR-823X set_static_route_table sub_4175CC os command injectionEPSS 4.7%CVE-2021-40411CRITICALAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] thEPSS 4.7%CVE-2013-10039HIGHGestioIP 3.0 ip_checkhost.cgi RCEEPSS 4.7%CVE-2022-29472CRITICALAn OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One SEPSS 4.7%CVE-2026-26213HIGHthingino-firmware api.cgi Unauthenticated Command Injection in Captive PortalEPSS 4.7%CVE-2023-6318CRITICALCommand injection in the processAnalyticsReport method from the com.webos.service.cloudupload serviceEPSS 4.7%CVE-2026-100852HIGHAzuraCast before 0.23.8 Command Injection via Streamer UsernameEPSS 4.6%CVE-2026-2084HIGHD-Link DIR-823X set_language os command injectionEPSS 4.6%CVE-2025-2717MEDIUMD-Link DIR-823X HTTP POST Request diag_nslookup sub_41710C os command injectionEPSS 4.6%CVE-2026-74849CRITICALRemote code execution vulnerabilityEPSS 4.6%CVE-2026-5352MEDIUMTrendnet TEW-657BRM setup.cgi edit os command injectionEPSS 4.6%CVE-2024-2707MEDIUMTenda AC10U WriteFacMac formWriteFacMac os command injectionEPSS 4.6%CVE-2022-25168—Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTarEPSS 4.6%CVE-2026-2210HIGHD-Link DIR-823X set_filtering sub_4211C8 os command injectionEPSS 4.6%