Weaknesses of type CWE-78

4,563 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2020-7351HIGHFonality Trixbox CE Post-Authentication Command InjectionEPSS 65.2%CVE-2021-27273HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System EPSS 65.0%CVE-2025-25256CRITICALAn improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinEPSS 64.7%CVE-2024-4883CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 64.5%CVE-2022-44149HIGHThe web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd inEPSS 64.4%CVE-2025-36604HIGHDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionEPSS 64.1%CVE-2024-47407CRITICALmySCADA myPRO OS Command InjectionEPSS 64.0%CVE-2020-4428CRITICALIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the systemEPSS 61.7%KEVCVE-2020-16205—Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1EPSS 61.1%CVE-2023-37928HIGHA post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fiEPSS 60.2%CVE-2021-3577HIGHAn unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attEPSS 60.2%CVE-2019-5485—NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repEPSS 58.8%CVE-2024-0986MEDIUMIssabel PBX Asterisk-Cli os command injectionEPSS 58.2%CVE-2019-5029CRITICALAn exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell EPSS 57.1%CVE-2021-33554HIGHUDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCEEPSS 57.0%CVE-2021-33548HIGHUDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCEEPSS 57.0%CVE-2021-33550HIGHUDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCEEPSS 57.0%CVE-2021-27104CRITICALAccellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed versEPSS 56.7%KEVCVE-2021-25297HIGHNagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/confiEPSS 56.7%KEVCVE-2013-3307HIGHLinksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metEPSS 55.7%