Weaknesses of type CWE-78

5,015 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2022-30534CRITICALAn OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364EPSS 75.0%CVE-2023-6019CRITICALRay Command Injection in cpu_profile ParameterEPSS 74.6%CVE-2025-1316CRITICALEdimax IC-7100 IP Camera OS Command InjectionEPSS 74.5%KEVCVE-2023-23076CRITICALOS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.EPSS 74.3%CVE-2017-5255—In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console EPSS 74.2%CVE-2019-12991HIGHCitrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).EPSS 74.1%KEVCVE-2021-25298HIGHNagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/confiEPSS 73.6%KEVCVE-2024-9916MEDIUMHuangDou UTCMS cli.php os command injectionEPSS 73.6%CVE-2026-110447CRITICALCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in thEPSS 73.3%KEVCVE-2023-47565HIGHLegacy VioStor NVREPSS 73.3%KEVCVE-2017-6334HIGHdnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands EPSS 72.6%KEVCVE-2026-73570HIGHA remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installedEPSS 71.7%KEVCVE-2022-34753HIGHA CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rEPSS 71.4%CVE-2021-4039CRITICALA command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS comEPSS 71.0%CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2022-44456CRITICALCONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server wEPSS 69.9%CVE-2023-3368CRITICALChamilo LMS Unauthenticated Command InjectionEPSS 69.7%CVE-2021-21805CRITICALAn OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially cEPSS 69.6%CVE-2016-11021HIGHsetSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand paraEPSS 69.6%KEVCVE-2025-36604HIGHDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionEPSS 69.2%