Weaknesses of type CWE-78

5,018 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-16492MEDIUMumijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injectionEPSS 3.9%CVE-2022-22140CRITICALAn os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specEPSS 3.9%CVE-2019-3919—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent EPSS 3.9%CVE-2019-3920—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTPEPSS 3.9%CVE-2020-3430HIGHCisco Jabber for Windows Protocol Handler Command Injection VulnerabilityEPSS 3.9%CVE-2026-31975HIGHCloud CLI WebSocket shell injectionEPSS 3.9%CVE-2021-28571HIGHAdobe After Effects improper neutralization of special elements could lead to remote code executionEPSS 3.9%CVE-2025-34024CRITICALEdimax EW-7438RPn Mini OS Command Injection via mp.aspEPSS 3.9%CVE-2024-51228MEDIUMAn issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1EPSS 3.9%CVE-2026-102059HIGHJunos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific informationEPSS 3.9%CVE-2024-2854MEDIUMTenda AC18 setsambacfg formSetSambaConf os command injectionEPSS 3.9%CVE-2023-38120HIGHAdtran SR400ac ping Command Injection Remote Code Execution VulnerabilityEPSS 3.9%CVE-2021-1264CRITICALCisco DNA Center Command Runner Command Injection VulnerabilityEPSS 3.9%CVE-2021-21888CRITICALAn OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4EPSS 3.9%CVE-2026-105740CRITICALLangflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverEPSS 3.9%CVE-2018-19007—In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable tEPSS 3.9%CVE-2016-15047HIGHAVTECH CloudSetup.cgi Authenticated Command InjectionEPSS 3.9%CVE-2025-66209CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database BackupEPSS 3.9%CVE-2022-44808CRITICALA command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to executeEPSS 3.9%CVE-2017-17407—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.EPSS 3.9%