Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-89308CRITICALArbitrary command execution in TrxTimeATTENDANCEEPSS 2.1%CVE-2026-59800CRITICAL9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install EndpointEPSS 2.1%CVE-2020-3336HIGHCisco TelePresence Collaboration Endpoint and RoomOS Software Command Injection VulnerabilityEPSS 2.1%CVE-2019-17096CRITICALBitdefender BOX 2 bootstrap get_image_size command injection vulnerabilityEPSS 2.1%CVE-2021-21414HIGHCommand injection vulnerability in @prisma/sdk in getPackedPackage functionEPSS 2.1%CVE-2025-56130HIGHOS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a craftEPSS 2.1%CVE-2026-120195CRITICALWAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injectionEPSS 2.1%CVE-2026-30302CRITICALThe command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanisEPSS 2.1%CVE-2021-39826HIGHAdobe Digital Editions Command Execution VulnerabilityEPSS 2.1%CVE-2026-30880CRITICALbaserCMS: OS command injection vulnerability in installerEPSS 2.1%CVE-2021-28204HIGHASUS BMC's firmware: command injection - Modify user’s information functionEPSS 2.1%CVE-2024-6342CRITICAL**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAEPSS 2.1%CVE-2023-30054CRITICALTOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a speciallyEPSS 2.1%CVE-2023-30053CRITICALTOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.EPSS 2.1%CVE-2018-19950—If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP SystEPSS 2.1%CVE-2026-19983MEDIUMGL.iNet XE3000 NAS Command Service gl_nas_sys os command injectionEPSS 2.1%CVE-2026-90619MEDIUM0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injectionEPSS 2.1%CVE-2022-46631CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the settEPSS 2.1%CVE-2022-46634CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the settEPSS 2.1%CVE-2021-32531CRITICALQSAN XEVO - Command Injection Following via Init functionEPSS 2.1%