Weaknesses of type CWE-78

4,599 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2011-10026CRITICALSpreecommerce < 0.50.x API RCEEPSS 2.6%CVE-2025-49537HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%CVE-2026-10872HIGHShibby Tomato Web UI rc start_vpnserver os command injectionEPSS 2.6%CVE-2026-35196HIGHChamilo LMS has OS Command Injection via export_all_certificates actionEPSS 2.6%CVE-2025-1244HIGHEmacs: shell injection vulnerability in gnu emacs via custom "man" uri schemeEPSS 2.6%CVE-2025-6897MEDIUMD-Link DI-7300G+ httpd_debug.asp os command injectionEPSS 2.6%CVE-2019-1864HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 2.6%CVE-2022-30311CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.6%CVE-2022-30310CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.6%CVE-2021-29083HIGHImproper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.EPSS 2.6%CVE-2021-47728CRITICALSelea Targa IP Camera Remote Code Execution via UtilsEPSS 2.6%CVE-2026-8450CRITICALHTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()EPSS 2.6%CVE-2020-36867HIGHNagios XI < 5.7.3 Command Injection in Report PDF DownloadEPSS 2.6%CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2021-36287HIGHDell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticEPSS 2.6%CVE-2026-26832CRITICALnode-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() functEPSS 2.6%CVE-2025-50194HIGHChamilo: OS Command Injection in /main/cron/lang/check_parse_lang.phpEPSS 2.6%CVE-2026-65091HIGHNVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploitEPSS 2.6%CVE-2026-9347MEDIUMEdimax EW-7438RPn webs formWizSurvey os command injectionEPSS 2.6%CVE-2025-50193HIGHChamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameterEPSS 2.6%