Weaknesses of type CWE-78

5,061 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-14863HIGHFileRun 2026.2.0 RCE via Thumbnail Generation Command InjectionEPSS 2.5%CVE-2026-34038CRITICALCoolify authenticated remote command injection leading to RCE and secret exfiltrationEPSS 2.5%CVE-2024-41992HIGHWi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library functEPSS 2.5%CVE-2020-2030HIGHPAN-OS: OS command injection vulnerability in the management interfaceEPSS 2.5%CVE-2026-106931HIGHSiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with rEPSS 2.5%KEVCVE-2026-56700CRITICALGrav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command InjectionEPSS 2.5%CVE-2024-11482CRITICALA vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through commaEPSS 2.5%CVE-2023-24762CRITICALOS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAEPSS 2.5%CVE-2026-110649CRITICALStills before 25.24.2 OS Command Injection via Media File NamesEPSS 2.5%CVE-2026-110635CRITICALwebp-converter before 3.0.0 OS Command Injection via File Names and OptionsEPSS 2.5%CVE-2025-26613CRITICALOS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIAEPSS 2.5%CVE-2026-2167MEDIUMTotolink WA300 cstecgi.cgi setAPNetwork os command injectionEPSS 2.5%CVE-2026-110641HIGH@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File NameEPSS 2.5%CVE-2022-4978CRITICALSteppschuh Remote Control Server 3.1.1.12 Unauthenticated RCEEPSS 2.5%CVE-2022-30303HIGHAn improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.EPSS 2.5%CVE-2021-21954CRITICALA command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 EPSS 2.5%CVE-2022-0841LOWOS Command Injection in ljharb/npm-lockfileEPSS 2.5%CVE-2026-101858MEDIUMRaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injectionEPSS 2.5%CVE-2026-61517HIGHNetis NX10 OS Command Injection via Ping Diagnostic HandlerEPSS 2.5%CVE-2026-9044HIGHCommand Injection Vulnerability in OpenVPN of TP-Link Archer AXE75EPSS 2.5%