Weaknesses of type CWE-78

4,591 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-71945CRITICALD-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocomEPSS 3.2%CVE-2026-71956CRITICALD-Link DWR-M961 Command Injection via app.cgiEPSS 3.2%CVE-2025-20292MEDIUMCisco NXOS Software Command Injection VulnerabilityEPSS 3.2%CVE-2026-41923CRITICALWDR201A WiFi Extender OS Command Injection via internet.cgiEPSS 3.2%CVE-2026-15027HIGHChanging｜CGServiSign - OS Command InjectionEPSS 3.2%CVE-2025-34187CRITICALIlevia EVE X1/X5 Server 4.7.18.0.eden Reverse RootshellEPSS 3.2%CVE-2025-56093HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 3.2%CVE-2017-16602—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7EPSS 3.2%CVE-2025-66213CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount PathEPSS 3.1%CVE-2025-56127HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 3.1%CVE-2026-6893HIGHDracut: dracut: root code execution via dhcp options command injectionEPSS 3.1%CVE-2025-54857CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8EPSS 3.1%CVE-2025-24971CRITICALOS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDropEPSS 3.1%CVE-2025-66212CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration FilenameEPSS 3.1%CVE-2021-22795CRITICALA CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause reEPSS 3.1%CVE-2022-48107CRITICALD-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vEPSS 3.1%CVE-2022-48108CRITICALD-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This EPSS 3.1%CVE-2026-17179HIGHIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 3.1%CVE-2012-10059CRITICALDolibarr ERP/CRM Post-Auth OS Command InjectionEPSS 3.1%CVE-2022-22984MEDIUMCommand InjectionEPSS 3.1%