Weaknesses of type CWE-78

5,061 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-6620MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionEPSS 2.5%CVE-2025-6621MEDIUMTOTOLINK CA300-PoE ap.so QuickSetting os command injectionEPSS 2.5%CVE-2018-1169—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User intEPSS 2.5%CVE-2025-6618MEDIUMTOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionEPSS 2.5%CVE-2025-6619MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionEPSS 2.5%CVE-2026-9343MEDIUMEdimax EW-7438RPn webs formWpsStart os command injectionEPSS 2.5%CVE-2026-9347MEDIUMEdimax EW-7438RPn webs formWizSurvey os command injectionEPSS 2.5%CVE-2025-49537HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.5%CVE-2023-36549HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2018-5553CRITICALCrestron DGE-100 Console Command Injection (FIXED)EPSS 2.5%CVE-2023-36548CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34989HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34985HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-36547CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-36550CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34987HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34986HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34988HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2026-62392HIGHApache Kylin: OS Command Injection via Async Query APIEPSS 2.5%CVE-2020-3586CRITICALCisco DNA Spaces Connector Command Injection VulnerabilityEPSS 2.5%