Weaknesses of type CWE-78

4,601 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-30286HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%CVE-2026-22224HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2EPSS 2.6%CVE-2020-25847HIGHCommand Injection Vulnerability in QTS and QuTS heroEPSS 2.6%CVE-2026-32238CRITICALOpenEMR has Remote Code Execution in backup functionalityEPSS 2.6%CVE-2026-25721HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.6%CVE-2026-3037HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.6%CVE-2026-85696CRITICALSadTalker OS Command Injection via Audio FilenameEPSS 2.6%CVE-2026-16766CRITICALCatalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render optionsEPSS 2.6%CVE-2020-7805—An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command inEPSS 2.6%CVE-2026-85672CRITICALzerox 1.1.20 OS Command Injection via Document URL File ExtensionEPSS 2.6%CVE-2022-44930CRITICALD-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.EPSS 2.6%CVE-2025-56097HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands EPSS 2.6%CVE-2025-56118HIGHOS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands viaEPSS 2.6%CVE-2025-56098HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 2.6%CVE-2025-56114HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.6%CVE-2025-1339MEDIUMTOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injectionEPSS 2.6%CVE-2024-57687CRITICALAn OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows reEPSS 2.6%CVE-2025-56102HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crEPSS 2.6%CVE-2023-28102HIGHCommand injection in discordrbEPSS 2.6%CVE-2026-42076CRITICALEvolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code ExecutionEPSS 2.6%