Weaknesses of type CWE-78

4,603 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2024-24623HIGHSoftaculous Webuzo FTP Management Command InjectionEPSS 1.9%CVE-2026-34796HIGHEndian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34794HIGHEndian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34792HIGHEndian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34797HIGHEndian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-9773HIGHUnraid Web Server ToggleState Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-9772HIGHUnraid Web Server FileUpload Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-1997HIGHOS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xEPSS 1.9%CVE-2020-5146—A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parametEPSS 1.9%CVE-2024-31705CRITICALAn issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of usEPSS 1.9%CVE-2026-77853HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A usEPSS 1.9%CVE-2023-36553CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 tEPSS 1.9%CVE-2026-51190CRITICALThe "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: trueEPSS 1.9%CVE-2026-50874HIGHAn OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execEPSS 1.9%CVE-2026-23520CRITICALArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEEPSS 1.9%CVE-2026-27487HIGHOpenClaw: Prevent shell injection in macOS keychain credential writeEPSS 1.9%CVE-2026-0756CRITICALgithub-kanban-mcp-server execAsync Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-1115HIGHopenBI Setting.php dlfile os command injectionEPSS 1.9%CVE-2014-0593HIGHsed command injectionEPSS 1.9%CVE-2020-3371MEDIUMCisco Integrated Management Controller Command Injection VulnerabilityEPSS 1.9%