Weaknesses of type CWE-78

5,019 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2021-36022CRITICALMagento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code ExecutionEPSS 3.4%CVE-2025-70329HIGHTOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd eEPSS 3.4%CVE-2018-0099—A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perEPSS 3.4%CVE-2025-34334HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPEEPSS 3.4%CVE-2012-10039CRITICALZEN Load Balancer Filelog Command ExecutionEPSS 3.4%CVE-2026-18482CRITICALCVE-2026-18482EPSS 3.4%CVE-2021-32749MEDIUMPossible RCE vulnerability in mailing action using mailutils (mail-whois)EPSS 3.4%CVE-2024-58287HIGHreNgine 2.2.0 Authenticated Command Injection via Scan Engine ConfigurationEPSS 3.4%CVE-2026-0755CRITICALgemini-mcp-tool execAsync Command Injection Remote Code Execution VulnerabilityEPSS 3.4%CVE-2022-33192CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.4%CVE-2022-33195CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.4%CVE-2022-32773CRITICALAn OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and EPSS 3.4%CVE-2022-38649CRITICALApache Airflow Pinot provider allowed Command InjectionEPSS 3.4%CVE-2026-72867CRITICALDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)EPSS 3.4%CVE-2021-41280CRITICALOS command injection in Sharetribe GoEPSS 3.4%CVE-2023-53963CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command InjectionEPSS 3.4%CVE-2026-90847CRITICALEFM ipTIME C200E System Setup iux_set.cgi os command injectionEPSS 3.4%CVE-2023-38692CRITICALCommand injection vulnerability in module management function in CloudExplorer LiteEPSS 3.4%CVE-2025-59361CRITICALOS command injection in Chaos Mesh via the cleanIptables mutationEPSS 3.4%CVE-2012-10040CRITICALOpenfiler v2.x NetworkCard Command ExecutionEPSS 3.4%