Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-82691CRITICALD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injectionEPSS 3.6%CVE-2026-85222CRITICALD-Link DNS-340L Add-On Center addon_center.cgi os command injectionEPSS 3.6%CVE-2026-82688CRITICALD-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injectionEPSS 3.6%CVE-2025-67888HIGHAn issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (wheEPSS 3.6%CVE-2022-40475CRITICALTOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.EPSS 3.6%CVE-2023-30628HIGHKiwi TCMS has command injection vulnerability in changelog.yml CI workflowEPSS 3.6%CVE-2023-26145HIGHThis affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.EPSS 3.6%CVE-2022-37718HIGHThe management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerabilEPSS 3.6%CVE-2026-4591MEDIUMkalcaddle kodbox fileThumb Endpoint app.php checkBin os command injectionEPSS 3.6%CVE-2024-58294HIGHFreePBX 16 Authenticated Remote Code Execution via API ModuleEPSS 3.6%CVE-2019-1865HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.6%CVE-2020-2037HIGHPAN-OS: OS command injection vulnerability in the management web interfaceEPSS 3.6%CVE-2023-7304CRITICALRuijie RG-UAC nmc_sync.php Command InjectionEPSS 3.6%CVE-2021-21289HIGHCommand Injection Vulnerability in MechanizeEPSS 3.5%CVE-2022-42493CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.5%CVE-2012-10029HIGHNagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command InjectionEPSS 3.5%CVE-2023-25583HIGHTwo OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted networEPSS 3.5%CVE-2023-25582HIGHTwo OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted networEPSS 3.5%CVE-2025-11490MEDIUMwonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injectionEPSS 3.5%CVE-2023-4221HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%