Weaknesses of type CWE-78

5,018 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-7553MEDIUMD-Link DIR-818LW System Time Page os command injectionEPSS 3.9%CVE-2023-26153HIGHVersions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_EPSS 3.8%CVE-2021-31891—A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on DebEPSS 3.8%CVE-2022-33150CRITICALAn OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network rEPSS 3.8%CVE-2024-0294HIGHTotolink LR1200GB cstecgi.cgi setUssd os command injectionEPSS 3.8%CVE-2024-0298HIGHTotolink N200RE cstecgi.cgi setDiagnosisCfg os command injectionEPSS 3.8%CVE-2024-0297HIGHTotolink N200RE cstecgi.cgi UploadFirmwareFile os command injectionEPSS 3.8%CVE-2024-0295HIGHTotolink LR1200GB cstecgi.cgi setWanCfg os command injectionEPSS 3.8%CVE-2024-0296HIGHTotolink N200RE cstecgi.cgi NTPSyncWithHost os command injectionEPSS 3.8%CVE-2024-0299HIGHTotolink N200RE cstecgi.cgi setTracerouteCfg os command injectionEPSS 3.8%CVE-2020-26301HIGHCommand injection in mscdex/ssh2EPSS 3.8%CVE-2022-27804HIGHAn os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One SEPSS 3.8%CVE-2025-11138MEDIUMmirweiye wenkucms common.php createPathOne os command injectionEPSS 3.8%CVE-2026-18900HIGHH3C NX15 Backend RPC esps file.exec os command injectionEPSS 3.8%CVE-2026-1544MEDIUMD-Link DIR-823X set_mode sub_41E2A0 os command injectionEPSS 3.8%CVE-2022-29851CRITICALdocumentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file EPSS 3.8%CVE-2020-15123CRITICALCommand injection in codecov (npm package)EPSS 3.8%CVE-2022-21178CRITICALAn os command injection vulnerability exists in the confsrv ucloud_add_new_node functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A sEPSS 3.8%CVE-2019-1885HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.8%CVE-2021-30166HIGHMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command InjectionEPSS 3.8%