Fallos del tipo CWE-78

5018 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-34041CRITICALSangfor Endpoint Detection and Response OS Command InjectionEPSS 7.5%CVE-2023-5301MEDIUMDedeCMS album_add.php AddMyAddon os command injectionEPSS 7.5%CVE-2024-28025HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 7.5%CVE-2024-28027HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 7.5%CVE-2025-2701MEDIUMAMTT Hotel Broadband Operation System port_setup.php popen os command injectionEPSS 7.4%CVE-2026-4253MEDIUMTenda AC8 Web UploadCfg route_set_user_policy_rule os command injectionEPSS 7.4%CVE-2025-34088HIGHPandora FMS Authenticated Remote Code Execution via Ping ModuleEPSS 7.4%CVE-2026-8273MEDIUMD-Link DNS-320 system_mgr.cgi cgi_merge_user os command injectionEPSS 7.4%CVE-2016-15048CRITICALAMTT HiBOS Command Injection RCE via server_ping.phpEPSS 7.4%CVE-2022-38066HIGHAn OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafEPSS 7.3%CVE-2025-13087HIGHCommand Injection in Opto22 Groov REST APIEPSS 7.3%CVE-2025-0798CRITICALMicroWorld eScan Antivirus Quarantine rtscanner os command injectionEPSS 7.3%CVE-2024-51092CRITICALLibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),EPSS 7.2%CVE-2020-2034HIGHPAN-OS: OS command injection vulnerability in GlobalProtect portalEPSS 7.2%CVE-2025-20029HIGHBIG-IP iControl REST and tmsh vulnerabilityEPSS 7.1%CVE-2015-10141CRITICALXdebug Remote Debugger Unauthenticated OS Command ExecutionEPSS 7.1%CVE-2021-42784—OS Command Injection in debug_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4EPSS 7.1%CVE-2026-2188HIGHUTT 进取 521G formPdbUpConfig sub_446B18 os command injectionEPSS 7.1%CVE-2026-8985CRITICALUnauthenticated Command InjectionEPSS 7.1%CVE-2023-3606MEDIUMTamronOS ping os command injectionEPSS 7.1%