Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2020-37279CRITICALeasy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge functionEPSS 1.9%CVE-2026-77853HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A usEPSS 1.9%CVE-2023-36553CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 tEPSS 1.9%CVE-2026-51190CRITICALThe "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: trueEPSS 1.9%CVE-2024-43648CRITICALAuthenticated command injection via <redacted>.exe <redacted> parameterEPSS 1.9%CVE-2025-23049HIGHMeridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.EPSS 1.9%CVE-2024-1115HIGHopenBI Setting.php dlfile os command injectionEPSS 1.9%CVE-2021-4281MEDIUMBrave UX for-the-badge combine-prs.yml os command injectionEPSS 1.9%CVE-2014-0593HIGHsed command injectionEPSS 1.9%CVE-2022-44252CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.EPSS 1.9%CVE-2026-82774HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and EPSS 1.9%CVE-2022-44249CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.EPSS 1.9%CVE-2022-44251CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.EPSS 1.9%CVE-2026-82777HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulEPSS 1.9%CVE-2026-82766HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If this vulnerability isEPSS 1.9%CVE-2026-82779HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnEPSS 1.9%CVE-2026-82791HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication WirEPSS 1.9%CVE-2026-82762HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 seriEPSS 1.9%CVE-2026-82794HIGHSolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OEPSS 1.9%CVE-2020-3371MEDIUMCisco Integrated Management Controller Command Injection VulnerabilityEPSS 1.9%