Weaknesses of type CWE-78

4,601 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2018-17558CRITICALHardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18EPSS 2.5%CVE-2018-1169—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User intEPSS 2.5%CVE-2026-28773CRITICALAuthenticated OS Command Injection via Ping Utility Leading to RCE as RootEPSS 2.5%CVE-2025-59834CRITICALCommand Injection in adb-mcp MCP ServerEPSS 2.5%CVE-2026-5679MEDIUMTotolink A3300R cstecgi.cgi vsetTr069Cfg os command injectionEPSS 2.5%CVE-2026-8500CRITICALWeb::Passwd versions through 0.03 for Perl is vulnerable to RCEEPSS 2.5%CVE-2018-5553CRITICALCrestron DGE-100 Console Command Injection (FIXED)EPSS 2.5%CVE-2022-45497CRITICALTenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommaEPSS 2.5%CVE-2022-45506CRITICALTenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName.EPSS 2.5%CVE-2026-62392HIGHApache Kylin: OS Command Injection via Async Query APIEPSS 2.5%CVE-2026-53876HIGHRadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution witEPSS 2.5%CVE-2026-56808HIGHDGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execuEPSS 2.5%CVE-2020-3586CRITICALCisco DNA Spaces Connector Command Injection VulnerabilityEPSS 2.5%CVE-2024-21755HIGHA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thEPSS 2.5%CVE-2026-22781CRITICALTinyWeb CGI Command InjectionEPSS 2.5%CVE-2026-2560MEDIUMkalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injectionEPSS 2.5%CVE-2026-30861CRITICALWeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration ValidationEPSS 2.5%CVE-2026-71989CRITICALMSI Radix AXE6600 v781521 Command Injection via porTrigger functionEPSS 2.5%CVE-2026-71985CRITICALMSI Radix AXE6600 v781521 Command Injection via accesscontrol FunctionEPSS 2.5%CVE-2026-71987CRITICALMSI Radix AXE6600 v781521 Command Injection via alg functionEPSS 2.5%