Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-108894CRITICALLinksys E1700 Static Route addStaticRoute os command injectionEPSS 2.2%CVE-2024-48635HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID paramEPSS 2.1%CVE-2024-48629HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameteEPSS 2.1%CVE-2024-48638HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parametEPSS 2.1%CVE-2026-16348HIGHCommand Injection Vulnerability in VPN connection of Archer BE800EPSS 2.1%CVE-2024-48637HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID paramEPSS 2.1%CVE-2024-48636HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID paramEPSS 2.1%CVE-2026-63766CRITICALGPT-SoVITS 20250606v2pro OS Command Injection via webui.pyEPSS 2.1%CVE-2024-48631HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in EPSS 2.1%CVE-2023-35762CRITICALOS Command Injection in INEA ME RTUEPSS 2.1%CVE-2024-45887HIGHDrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameEPSS 2.1%CVE-2024-45884HIGHDrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameEPSS 2.1%CVE-2024-45890HIGHDrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parametEPSS 2.1%CVE-2025-2773HIGHBEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution VulnerabilityEPSS 2.1%CVE-2021-33534HIGHWEIDMUELLER: WLAN devices affected by OS Command Injection vulnerabilityEPSS 2.1%CVE-2026-5547MEDIUMTenda AC10 httpd formAddMacfilterRule os command injectionEPSS 2.1%CVE-2026-3037HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-20764HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-9543CRITICALTotolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injectionEPSS 2.1%CVE-2024-2162HIGHAuthenticated Remote Code Execution in Kiloview NDI N series productsEPSS 2.1%