Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-15496MEDIUMSonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injectionEPSS 2.0%CVE-2012-10033CRITICALNarcissus backend.php Image Configuration Command InjectionEPSS 2.0%CVE-2025-29269CRITICALALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoinEPSS 2.0%CVE-2022-48126CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the settingEPSS 2.0%CVE-2022-48122CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the settingEPSS 2.0%CVE-2022-48124CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the settingEPSS 2.0%CVE-2022-48123CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the settiEPSS 2.0%CVE-2022-48125CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the settingEPSS 2.0%CVE-2022-48121CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/EPSS 2.0%CVE-2022-3210HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routerEPSS 2.0%CVE-2026-8217MEDIUMIndustrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injectionEPSS 2.0%CVE-2026-18587HIGHWavlink WL-NU516U1 Config Import os command injectionEPSS 2.0%CVE-2020-5350HIGHDell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM componenEPSS 2.0%CVE-2026-53611CRITICALLooking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input ValidationEPSS 2.0%CVE-2024-44342HIGHD-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the wl(0).(0)_ssid parameter. This EPSS 2.0%CVE-2026-53479HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 2.0%CVE-2026-19682CRITICALCommand InjectionEPSS 2.0%CVE-2026-27728CRITICALOneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()EPSS 2.0%CVE-2024-5291HIGHD-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution VulnerabilityEPSS 2.0%CVE-2024-5295HIGHD-Link G416 flupl self Command Injection Remote Code Execution VulnerabilityEPSS 2.0%