Weaknesses of type CWE-78

4,592 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-34093HIGHPolycom HDX Series Telnet Command Injection via lan tracerouteEPSS 2.9%CVE-2021-28571HIGHAdobe After Effects improper neutralization of special elements could lead to remote code executionEPSS 2.9%CVE-2026-82703MEDIUMEdimax BR-6214K asp_setPing Endpoint ping.asp system os command injectionEPSS 2.9%CVE-2026-82702MEDIUMEdimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injectionEPSS 2.9%CVE-2026-94490MEDIUMOctoPrint Command API system.py executeSystemCommand os command injectionEPSS 2.9%CVE-2026-38820HIGHopenNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on EPSS 2.9%CVE-2023-6901HIGHcodelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injectionEPSS 2.9%CVE-2026-58459HIGHgpsd gpsprof Command Injection via gnuplot plot title subtype fieldEPSS 2.9%CVE-2025-34112CRITICALRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCEEPSS 2.9%CVE-2026-19599CRITICALRemote Code Execution vulnerabilityEPSS 2.9%CVE-2024-4965MEDIUMD-Link DAR-7000-40 resmanage.php os command injectionEPSS 2.9%CVE-2022-30308CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.9%CVE-2022-30309CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.9%CVE-2026-25857HIGHTenda G300-F Command Injection via formSetWanDiagEPSS 2.9%CVE-2012-10041CRITICALWAN Emulator v2.3 Command ExecutionEPSS 2.8%CVE-2018-6342CRITICALreact-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoEPSS 2.8%CVE-2026-28269MEDIUMKiteworks Core has an OS Command InjectionEPSS 2.8%CVE-2025-56089HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.8%CVE-2025-56077HIGHOS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST requEPSS 2.8%CVE-2025-56079HIGHOS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a craEPSS 2.8%