Weaknesses of type CWE-78

4,591 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2021-24033—react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be EPSS 3.3%CVE-2026-81467CRITICALDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command EPSS 3.3%CVE-2025-7850CRITICALAuthenticated OS command executionEPSS 3.3%CVE-2025-56094HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 3.3%CVE-2025-1369LOWMicroWord eScan Antivirus USB Password os command injectionEPSS 3.3%CVE-2019-10958—Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote auEPSS 3.3%CVE-2026-60102HIGHHorde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb DriverEPSS 3.3%CVE-2025-59361CRITICALOS command injection in Chaos Mesh via the cleanIptables mutationEPSS 3.3%CVE-2026-7119HIGHTenda HG3 formCountrystr os command injectionEPSS 3.3%CVE-2025-3729MEDIUMSourceCodester Web-based Pharmacy Product Management System Database Backup backup.php os command injectionEPSS 3.3%CVE-2022-30541CRITICALAn OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and EPSS 3.3%CVE-2023-43482HIGHA command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322EPSS 3.3%CVE-2026-78488MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 3.2%CVE-2026-71921CRITICALDrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgiEPSS 3.2%CVE-2022-43325CRITICALAn unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.*EPSS 3.2%CVE-2019-1581CRITICALPAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interfaceEPSS 3.2%CVE-2025-30007HIGHHestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record ManagementEPSS 3.2%CVE-2023-26153HIGHVersions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_EPSS 3.2%CVE-2024-10966MEDIUMTOTOLINK X18 cstecgi.cgi os command injectionEPSS 3.2%CVE-2022-42492CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.2%