Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2024-50567MEDIUMAn improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allowEPSS 2.2%CVE-2026-108895CRITICALLinksys E1700 setDMZ os command injectionEPSS 2.2%CVE-2016-10541—The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications thatEPSS 2.2%CVE-2026-10871HIGHShibby Tomato Web UI rc start_6rd_tunnel os command injectionEPSS 2.2%CVE-2026-10870HIGHShibby Tomato Web UI rc start_dhcpc os command injectionEPSS 2.2%CVE-2026-5977CRITICALTotolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionEPSS 2.2%CVE-2026-28269MEDIUMKiteworks Core has an OS Command InjectionEPSS 2.2%CVE-2025-56107HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 2.2%CVE-2026-73172CRITICALNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraEPSS 2.2%CVE-2023-26155HIGHAll versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize EPSS 2.2%CVE-2022-42496CRITICALOS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to EPSS 2.2%CVE-2022-41642CRITICALOS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS commandEPSS 2.2%CVE-2026-106126CRITICALCommand InjectionEPSS 2.2%CVE-2025-9972CRITICALPlanet Technology｜Industrial Cellular Gateway - OS Command InjectionEPSS 2.2%CVE-2026-86394HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 2.2%CVE-2026-86399HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 2.2%CVE-2026-86395HIGHDell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.EPSS 2.2%CVE-2026-50289HIGHsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on LinuxEPSS 2.2%CVE-2026-82678MEDIUMdiem-project diem Administrative Console actions.class.php executeCommand os command injectionEPSS 2.2%CVE-2026-90788MEDIUMmagicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injectionEPSS 2.2%