Weaknesses of type CWE-78

4,603 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2022-43643HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers.EPSS 1.9%CVE-2026-82636HIGHQubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled quEPSS 1.9%CVE-2022-47853CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stablEPSS 1.9%CVE-2022-20871MEDIUMCisco Secure Web Appliance Privilege Escalation VulnerabilityEPSS 1.9%CVE-2021-36011HIGHAdobe Illustrator improper neutralization of special elements used in an OS commandEPSS 1.9%CVE-2025-61304CRITICALOS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.EPSS 1.9%CVE-2019-25289HIGHINIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command ExecutionEPSS 1.9%CVE-2011-10017CRITICALSnort Report nmap.php/nbtscan.php RCEEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.9%CVE-2023-27521HIGHOS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F vEPSS 1.9%CVE-2023-27514HIGHOS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versiEPSS 1.9%CVE-2023-40072HIGHOS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS commaEPSS 1.9%CVE-2026-41926CRITICALWDR201A WiFi Extender OS Command Injection via firewall.cgiEPSS 1.9%CVE-2024-8075MEDIUMTOTOLINK AC1200 T8 setDiagnosisCfg os command injectionEPSS 1.9%CVE-2026-81942HIGHPLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web ServerEPSS 1.9%CVE-2023-43892CRITICALNetis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This EPSS 1.9%CVE-2024-24622HIGHSoftaculous Webuzo Password Reset Command InjectionEPSS 1.9%CVE-2026-34793HIGHEndian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34797HIGHEndian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2024-24623HIGHSoftaculous Webuzo FTP Management Command InjectionEPSS 1.9%