Fallos del tipo CWE-78

4576 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2022-4221CRITICALOS command injection in ASUS M25 NASEPSS 4.9%CVE-2021-21016CRITICALMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 4.9%CVE-2024-0293MEDIUMTotolink LR1200GB cstecgi.cgi setUploadSetting os command injectionEPSS 4.8%CVE-2025-7097CRITICALComodo Internet Security Premium Manifest File cis_update_x64.xml os command injectionEPSS 4.8%CVE-2025-9727MEDIUMD-Link DIR-816L soap.cgi soapcgi_main os command injectionEPSS 4.8%CVE-2022-45915HIGHILIAS before 7.16 allows OS Command Injection.EPSS 4.8%CVE-2023-0935MEDIUMDolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injectionEPSS 4.8%CVE-2025-7382HIGHA command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achievEPSS 4.8%CVE-2023-2574HIGHAuthenticated Command InjectionEPSS 4.8%CVE-2023-2573HIGHAuthenticated Command InjectionEPSS 4.8%CVE-2025-50201CRITICALWeGIA OS Command Injection in debug_info.php parameter 'branch'EPSS 4.7%CVE-2026-15511CRITICALComfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injectionEPSS 4.7%CVE-2026-2152HIGHD-Link DIR-615 Web Configuration adv_routing.php os command injectionEPSS 4.7%CVE-2021-40411CRITICALAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] thEPSS 4.7%CVE-2025-6899MEDIUMD-Link DI-7300G+/DI-8200G msp_info.htm os command injectionEPSS 4.7%CVE-2013-10039HIGHGestioIP 3.0 ip_checkhost.cgi RCEEPSS 4.7%CVE-2023-6318CRITICALCommand injection in the processAnalyticsReport method from the com.webos.service.cloudupload serviceEPSS 4.7%CVE-2022-45639HIGHOS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m EPSS 4.7%CVE-2026-3485CRITICALD-Link DIR-868L SSDP Service sub_1BF84 os command injectionEPSS 4.7%CVE-2014-125118CRITICALeScan 5.5-2 Web Management Console Command InjectionEPSS 4.7%