Weaknesses of type CWE-78

5,018 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-59831HIGH`git-comiters` Command Injection vulnerabilityEPSS 4.2%CVE-2021-21018CRITICALMagnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code ExecutionEPSS 4.2%CVE-2022-50795HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpEPSS 4.2%CVE-2023-6309MEDIUMmoses-smt mosesdecoder trans_result.php os command injectionEPSS 4.2%CVE-2022-40189CRITICALApache Airlfow Pig Provider RCEEPSS 4.2%CVE-2025-7097CRITICALComodo Internet Security Premium Manifest File cis_update_x64.xml os command injectionEPSS 4.1%CVE-2021-27476CRITICALRockwell Automation FactoryTalk AssetCentre OS Command InjectionEPSS 4.1%CVE-2026-8632HIGHHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code ExecutionEPSS 4.1%CVE-2012-10041CRITICALWAN Emulator v2.3 Command ExecutionEPSS 4.1%CVE-2026-119742HIGHNagios XI < 2026R2 OS Command Injection via mibs.phpEPSS 4.1%CVE-2019-14894HIGHA flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code executEPSS 4.1%CVE-2026-7096HIGHTenda HG3 formgponConf os command injectionEPSS 4.1%CVE-2026-108576CRITICALTOZED X300 IPPingDiagnostics process_ping os command injectionEPSS 4.1%CVE-2025-67840HIGHMultiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_EPSS 4.1%CVE-2024-2812MEDIUMTenda AC15 WriteFacMac formWriteFacMac os command injectionEPSS 4.0%CVE-2021-3584—A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration opEPSS 4.0%CVE-2025-11407MEDIUMD-Link DI-7001 MINI upgrade_filter.asp os command injectionEPSS 4.0%CVE-2024-14005CRITICALNagios XI < 2024R1.2 Command Injection via Docker WizardEPSS 4.0%CVE-2025-34284CRITICALNagios XI < 2024R2 Authenticated Command Injection via WinRM PluginEPSS 4.0%CVE-2021-33191—MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocolEPSS 4.0%