Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-105407HIGHOS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5EPSS 1.8%CVE-2022-51019HIGHAkaunting before 2.1.31 OS Command Injection via app aliasEPSS 1.8%CVE-2026-0759CRITICALKatana Network Development Starter Kit executeCommand Command Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2020-26294HIGHExposure of server configurationEPSS 1.8%CVE-2023-32147MEDIUMD-Link DIR-2640 LocalIPAddress Command Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2023-32151MEDIUMD-Link DIR-2640 DestNetwork Command Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-44340HIGHD-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and sEPSS 1.8%CVE-2022-43550CRITICALA command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows EPSS 1.8%CVE-2024-57011HIGHTOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScEPSS 1.8%CVE-2026-35196HIGHChamilo LMS has OS Command Injection via export_all_certificates actionEPSS 1.8%CVE-2026-7416MEDIUMPolarVista xcode-mcp-server MCP index.ts run_tests os command injectionEPSS 1.8%CVE-2023-23367MEDIUMQTS, QuTS hero, QuTScloudEPSS 1.8%CVE-2026-87673HIGHAn OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d anEPSS 1.8%CVE-2026-7823CRITICALTotolink A8000RU cstecgi.cgi setAppFilterCfg os command injectionEPSS 1.8%CVE-2024-11066HIGHD-Link DSL6740C - OS Command InjectionEPSS 1.8%CVE-2022-37902HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.8%CVE-2025-1819MEDIUMTenda AC7 1200M telnet TendaTelnet os command injectionEPSS 1.8%CVE-2023-3767CRITICALOS command injection on EasyPHP Webserver EPSS 1.8%CVE-2026-53876HIGHRadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution witEPSS 1.8%CVE-2026-7154CRITICALTotolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionEPSS 1.8%