Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-82794HIGHSolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OEPSS 1.9%CVE-2026-82777HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulEPSS 1.9%CVE-2026-70374HIGHHashBrown CMS - OS Command Injection in Media Upload Thumbnail GenerationEPSS 1.9%CVE-2026-78037HIGHXiiaozet LK100W OS Command InjectionEPSS 1.9%CVE-2021-43928CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving compoEPSS 1.9%CVE-2026-100896CRITICALTOTOLINK N150RT Web Management formWlSiteSurvey system os command injectionEPSS 1.9%CVE-2026-113390CRITICALDrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectionEPSS 1.9%CVE-2026-80145CRITICALLantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordEPSS 1.9%CVE-2023-7311CRITICALBYTEVALUE Intelligent Flow Control Router Command InjectionEPSS 1.9%CVE-2024-6247MEDIUMWyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-6115CRITICALTotolink A7100RU CGI cstecgi.cgi setAppCfg os command injectionEPSS 1.9%CVE-2026-5995CRITICALTotolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injectionEPSS 1.9%CVE-2026-6138CRITICALTotolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injectionEPSS 1.9%CVE-2026-6139CRITICALTotolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injectionEPSS 1.9%CVE-2026-6154CRITICALTotolink A7100RU CGI cstecgi.cgi setWizardCfg os command injectionEPSS 1.9%CVE-2026-6131CRITICALTotolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injectionEPSS 1.9%CVE-2024-5241MEDIUMHuashi Private Cloud CDN Live Streaming Acceleration Server ipconfig_new.php os command injectionEPSS 1.9%CVE-2026-6156CRITICALTotolink A7100RU CGI cstecgi.cgi setIpQosRules os command injectionEPSS 1.9%CVE-2026-5996CRITICALTotolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionEPSS 1.9%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%