Weaknesses of type CWE-78

4,594 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-10873HIGHShibby Tomato Web UI rstats rstats_path os command injectionEPSS 2.7%CVE-2025-65008CRITICALOS Command Injection in WODESYS WD-R608U routerEPSS 2.7%CVE-2021-21876CRITICALSpecially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests toEPSS 2.7%CVE-2021-21877CRITICALSpecially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests EPSS 2.7%CVE-2018-25083CRITICALThe pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.EPSS 2.7%CVE-2023-26921CRITICALOS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.EPSS 2.7%CVE-2022-42999HIGHD-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /gEPSS 2.7%CVE-2026-7256HIGH** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 coEPSS 2.7%CVE-2024-5181CRITICALCommand Injection in mudler/localaiEPSS 2.7%CVE-2025-35027HIGHUnitree Multiple Robotic Products Command InjectionEPSS 2.7%CVE-2024-4343CRITICALPython Command Injection in imartinez/privategptEPSS 2.7%CVE-2025-1546MEDIUMBDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injectionEPSS 2.7%CVE-2026-15495MEDIUMSonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injectionEPSS 2.7%CVE-2026-24841CRITICALDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket EndpointEPSS 2.7%CVE-2021-33721—A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elementEPSS 2.7%CVE-2025-55037CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.EPSS 2.7%CVE-2026-22225HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0EPSS 2.7%CVE-2026-58452HIGHJAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC EndpointEPSS 2.7%CVE-2011-2195—A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoEPSS 2.7%CVE-2022-24393HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.7%