Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-9458CRITICALTotolink A8000RU Web Management cstecgi.cgi setWanCfg os command injectionEPSS 2.1%CVE-2026-25196HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-24452HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-25721HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-25037HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-23702HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-9457CRITICALTotolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injectionEPSS 2.1%CVE-2026-22229HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0EPSS 2.1%CVE-2020-7825HIGHA vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An EPSS 2.1%CVE-2026-9388CRITICALTotolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injectionEPSS 2.1%CVE-2021-31838HIGHCommand injection through environment variable in MVISION EDREPSS 2.1%CVE-2024-4299HIGHHGiga iSherlock - Command InjectionEPSS 2.1%CVE-2024-4298HIGHHGiga iSherlock - Command InjectionEPSS 2.1%CVE-2020-12148MEDIUMOS Command Injection - nslookup APIEPSS 2.1%CVE-2026-15428HIGHOS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800vEPSS 2.1%CVE-2024-41314MEDIUMTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disableEPSS 2.1%CVE-2023-29944CRITICALMetersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom EPSS 2.1%CVE-2024-42633HIGHA Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an aEPSS 2.1%CVE-2026-116219HIGHDolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump ParameterEPSS 2.1%CVE-2026-113506CRITICALaaPanel File Manager common.py ExecShell os command injectionEPSS 2.1%