Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2025-44882CRITICALA command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary coEPSS 1.9%CVE-2026-16865HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 1.9%CVE-2022-37897CRITICALThere is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets desEPSS 1.9%CVE-2024-8075MEDIUMTOTOLINK AC1200 T8 setDiagnosisCfg os command injectionEPSS 1.9%CVE-2022-3226HIGHAn OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older thanEPSS 1.9%CVE-2026-81942HIGHPLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web ServerEPSS 1.9%CVE-2021-20017—A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobodEPSS 1.9%CVE-2026-15495MEDIUMSonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injectionEPSS 1.9%CVE-2019-25289HIGHINIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command ExecutionEPSS 1.9%CVE-2024-24622HIGHSoftaculous Webuzo Password Reset Command InjectionEPSS 1.9%CVE-2024-24623HIGHSoftaculous Webuzo FTP Management Command InjectionEPSS 1.9%CVE-2022-43184CRITICALD-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.EPSS 1.9%CVE-2026-9772HIGHUnraid Web Server FileUpload Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-9773HIGHUnraid Web Server ToggleState Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-5802MEDIUMidachev mcp-javadc HTTP os command injectionEPSS 1.9%CVE-2025-45491CRITICALLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the usernaEPSS 1.9%CVE-2023-1997HIGHOS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xEPSS 1.9%CVE-2024-31705CRITICALAn issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of usEPSS 1.9%CVE-2025-34056CRITICALAVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionEPSS 1.9%CVE-2026-105106HIGHKoha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled taskEPSS 1.9%