Weaknesses of type CWE-78

5,019 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2013-10073HIGHNagios XI < 2012R1.6 Auto-Discovery Shell Command InjectionEPSS 3.4%CVE-2026-74233CRITICALZbtlink MQWrt infosrvd Command InjectionEPSS 3.4%CVE-2024-7066MEDIUMF-logic DataCube3 HTTP POST Request config_time_sync.php os command injectionEPSS 3.4%CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2022-42491CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.4%CVE-2022-42492CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.4%CVE-2020-37123CRITICALPinger 1.0 - Remote Code ExecutionEPSS 3.3%CVE-2022-30541CRITICALAn OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and EPSS 3.3%CVE-2023-31128HIGHNextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command InjectionEPSS 3.3%CVE-2025-34151CRITICALShenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command InjectionEPSS 3.3%CVE-2026-102096HIGHKiteworks Core OS command injectionEPSS 3.3%CVE-2025-66644HIGHArray Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.EPSS 3.3%KEVCVE-2022-33193CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.3%CVE-2022-33194CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.3%CVE-2024-9001MEDIUMTOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injectionEPSS 3.3%CVE-2023-4464HIGHPoly VVX 601 Diagnostic Telnet Mode os command injectionEPSS 3.3%CVE-2025-4032LOWinclusionAI AWorld shell_tool.py subprocess.Popen os command injectionEPSS 3.3%CVE-2026-25244CRITICALWebdriverIO has Command Injection in the BrowserStack ServiceEPSS 3.3%CVE-2025-7850CRITICALAuthenticated OS command executionEPSS 3.3%CVE-2021-3198MEDIUMIvanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionEPSS 3.3%