Weaknesses of type CWE-78

4,592 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-58457CRITICALShenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspEPSS 2.9%CVE-2026-37751CRITICALAn OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attacEPSS 2.9%CVE-2026-19188CRITICALHaiwell IoT Cloud HMI Gateway OS Command InjectionEPSS 2.9%CVE-2026-52102CRITICALAn OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commaEPSS 2.9%CVE-2024-53939HIGHAn issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/EPSS 2.9%CVE-2021-21015HIGHMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 2.9%CVE-2012-10046CRITICALE-Mail Security Virtual Appliance learn-msg.cgi Command InjectionEPSS 2.9%CVE-2025-59359CRITICALOS command injection in Chaos Mesh via the cleanTcs mutationEPSS 2.9%CVE-2025-56085HIGHOS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitraEPSS 2.9%CVE-2026-27550HIGHCommand Injection in Field_Shadow_Password ClassEPSS 2.9%CVE-2026-27554HIGHCommand Injection in /index.php/ajax/save_iodd_parametersEPSS 2.9%CVE-2025-27140CRITICALWeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)EPSS 2.9%CVE-2026-27558HIGHCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesEPSS 2.9%CVE-2026-27559HIGHCommand Injection via GET in /api/status/dataEPSS 2.9%CVE-2026-27551HIGHCommand Injection in /index.php/ajax/parameterManageEPSS 2.9%CVE-2026-27548HIGHCommand Injection in /index.php/ajax/get_iodd_port_infoEPSS 2.9%CVE-2026-27547HIGHCommand Injection in /index.php/ajax/get_iodd_menu_infoEPSS 2.9%CVE-2026-27549HIGHCommand Injection in /index.php/attached_devices_tab/do_uploadEPSS 2.9%CVE-2014-0156—Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argumentEPSS 2.9%CVE-2026-26478CRITICALA shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a speciEPSS 2.9%