Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-34187CRITICALIlevia EVE X1/X5 Server 4.7.18.0.eden Reverse RootshellEPSS 3.3%CVE-2019-10958—Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote auEPSS 3.3%CVE-2026-69096HIGHOpenWrt luci-app-dockerman Read ACL Remote Code ExecutionEPSS 3.3%CVE-2026-60102HIGHHorde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb DriverEPSS 3.3%CVE-2026-7119HIGHTenda HG3 formCountrystr os command injectionEPSS 3.3%CVE-2025-24971CRITICALOS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDropEPSS 3.3%CVE-2025-66212CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration FilenameEPSS 3.3%CVE-2026-82004CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.3%CVE-2023-43482HIGHA command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322EPSS 3.3%CVE-2026-110645CRITICALVideo-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()EPSS 3.2%CVE-2026-34234CRITICALCtrlPanel: Unauthenticated RCE using installer scriptEPSS 3.2%CVE-2025-30007HIGHHestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record ManagementEPSS 3.2%CVE-2021-36022CRITICALMagento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code ExecutionEPSS 3.2%CVE-2019-1581CRITICALPAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interfaceEPSS 3.2%CVE-2024-10966MEDIUMTOTOLINK X18 cstecgi.cgi os command injectionEPSS 3.2%CVE-2026-8112MEDIUM8421bit MiniClaw kernel.ts executeCognitivePulse os command injectionEPSS 3.2%CVE-2025-8259MEDIUMVaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injectionEPSS 3.2%CVE-2022-22984MEDIUMCommand InjectionEPSS 3.2%CVE-2026-33475CRITICALLangflow GitHub Actions Shell InjectionEPSS 3.2%CVE-2026-16445HIGHDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd moduleEPSS 3.2%