Weaknesses of type CWE-78

5,015 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-54404HIGHMultiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted networEPSS 4.6%CVE-2025-54403HIGHMultiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted networEPSS 4.6%CVE-2018-1167—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User inEPSS 4.6%CVE-2026-4585CRITICALTiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injectionEPSS 4.5%CVE-2026-7609MEDIUMTRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injectionEPSS 4.5%CVE-2022-33204CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.5%CVE-2022-33206CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.5%CVE-2022-33205CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.5%CVE-2022-33207CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.5%CVE-2026-2175HIGHD-Link DIR-823X set_upnp sub_420618 os command injectionEPSS 4.5%CVE-2026-23515CRITICALRCE - Command Injection in Signal K set-system-time pluginEPSS 4.5%CVE-2021-30361—The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a commEPSS 4.5%CVE-2012-10059CRITICALDolibarr ERP/CRM Post-Auth OS Command InjectionEPSS 4.5%CVE-2022-40222CRITICALAn OS command injection vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A speciEPSS 4.4%CVE-2026-3301CRITICALTotolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injectionEPSS 4.4%CVE-2024-3880MEDIUMTenda W30E WriteFacMac formWriteFacMac os command injectionEPSS 4.4%CVE-2021-20035MEDIUMImproper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary coEPSS 4.4%KEVCVE-2026-58479CRITICALSustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command InjectionEPSS 4.4%CVE-2024-8234HIGH** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in theEPSS 4.4%CVE-2020-5758—Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attaEPSS 4.4%