Weaknesses of type CWE-78

4,603 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-78037HIGHXiiaozet LK100W OS Command InjectionEPSS 1.9%CVE-2026-34005HIGHIn Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters EPSS 1.9%CVE-2026-82774HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and EPSS 1.9%CVE-2026-27130CRITICALDokploy has Command Injection in its Service OperationsEPSS 1.9%CVE-2026-82777HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulEPSS 1.9%CVE-2026-82791HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication WirEPSS 1.9%CVE-2026-82766HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If this vulnerability isEPSS 1.9%CVE-2026-82779HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnEPSS 1.9%CVE-2026-82794HIGHSolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OEPSS 1.9%CVE-2026-70375HIGHHashBrown CMS - OS Command Injection via Git Deployer Branch FieldEPSS 1.9%CVE-2020-3371MEDIUMCisco Integrated Management Controller Command Injection VulnerabilityEPSS 1.9%CVE-2026-82762HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 seriEPSS 1.9%CVE-2021-43928CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving compoEPSS 1.9%CVE-2023-42123HIGHControl Web Panel mysql_manager Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-7311CRITICALBYTEVALUE Intelligent Flow Control Router Command InjectionEPSS 1.9%CVE-2024-5241MEDIUMHuashi Private Cloud CDN Live Streaming Acceleration Server ipconfig_new.php os command injectionEPSS 1.9%CVE-2022-43973HIGHArbitrary code execution in Linksys WRT54GLEPSS 1.9%CVE-2026-45633CRITICALDokploy: Command Injection in /docker-container-logs EndpointEPSS 1.9%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%CVE-2026-24700HIGHAn OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 anEPSS 1.9%