Weaknesses of type CWE-78

5,062 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2023-51698CRITICALAtril's CBT comic book parsing vulnerable to Remote Code ExecutionEPSS 2.4%CVE-2025-1370MEDIUMMicroWorld eScan Antivirus Autoscan USB epsdaemon sprintf os command injectionEPSS 2.4%CVE-2026-110634CRITICALgit-diff before 2.0.7 OS Command Injection via gitDiff Input StringsEPSS 2.3%CVE-2023-3975HIGHOS Command Injection in jgraph/drawioEPSS 2.3%CVE-2020-5322CRITICALDell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated mEPSS 2.3%CVE-2025-29042CRITICALAn issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232cEPSS 2.3%CVE-2025-55037CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.EPSS 2.3%CVE-2025-6897MEDIUMD-Link DI-7300G+ httpd_debug.asp os command injectionEPSS 2.3%CVE-2020-11016CRITICALRemote code execution in Message sending functionality in IntelMQ ManagerEPSS 2.3%CVE-2020-36762MEDIUMONS Digital RAS Collection Instrument comment.yml jobs os command injectionEPSS 2.3%CVE-2026-3696MEDIUMTotolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injectionEPSS 2.3%CVE-2026-65638CRITICALImproper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commaEPSS 2.3%CVE-2021-21386CRITICALImproper Neutralization of Argument Delimiters in a Decompiling Package ProcessEPSS 2.3%CVE-2024-52320CRITICALPlanet Technology Planet WGS-804HPT Command InjectionEPSS 2.3%CVE-2026-90706MEDIUMD-Link DWR-M921 formWsc os command injectionEPSS 2.3%CVE-2026-90705MEDIUMD-Link DWR-M921 Boa Dispatch Table formsysCmd os command injectionEPSS 2.3%CVE-2025-64127CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.3%CVE-2026-21861CRITICALbaserCMS: OS Command Injection Leading to Remote Code Execution (RCE)EPSS 2.3%CVE-2025-64128CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.3%CVE-2025-64126CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.3%