Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2023-4221HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%CVE-2022-42490CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.5%CVE-2022-33140—Improper Neutralization of Command Elements in Shell User Group ProviderEPSS 3.5%CVE-2019-1850HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.5%CVE-2025-34029CRITICALEdimax EW-7438RPn Mini OS Command Injection via syscmd.aspEPSS 3.5%CVE-2019-12690HIGHCisco Firepower Management Center Command Injection VulnerabilityEPSS 3.5%CVE-2026-76197CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2026-76195CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2026-48362CRITICALColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2022-33192CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.5%CVE-2022-33195CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.5%CVE-2022-32773CRITICALAn OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and EPSS 3.5%CVE-2020-8270—An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 EPSS 3.5%CVE-2025-34115HIGHOP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.phpEPSS 3.5%CVE-2026-113802CRITICALWavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file HandlerEPSS 3.5%CVE-2025-56088HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request toEPSS 3.5%CVE-2020-37282CRITICALoffice-converter through 1.0.2 OS Command Injection via fileName in generatePdfEPSS 3.4%CVE-2023-46683HIGHA post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada GigabEPSS 3.4%CVE-2023-47209HIGHA post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.EPSS 3.4%CVE-2023-42664HIGHA post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VEPSS 3.4%