Fallos del tipo CWE-78

4591 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-71945CRITICALD-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocomEPSS 3.2%CVE-2026-71956CRITICALD-Link DWR-M961 Command Injection via app.cgiEPSS 3.2%CVE-2025-20292MEDIUMCisco NXOS Software Command Injection VulnerabilityEPSS 3.2%CVE-2026-41923CRITICALWDR201A WiFi Extender OS Command Injection via internet.cgiEPSS 3.2%CVE-2026-15027HIGHChanging｜CGServiSign - OS Command InjectionEPSS 3.2%CVE-2025-34187CRITICALIlevia EVE X1/X5 Server 4.7.18.0.eden Reverse RootshellEPSS 3.2%CVE-2025-56093HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 3.2%CVE-2017-16602—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7EPSS 3.2%CVE-2025-66213CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount PathEPSS 3.1%CVE-2025-56127HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 3.1%CVE-2026-6893HIGHDracut: dracut: root code execution via dhcp options command injectionEPSS 3.1%CVE-2025-54857CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8EPSS 3.1%CVE-2025-24971CRITICALOS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDropEPSS 3.1%CVE-2025-66212CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration FilenameEPSS 3.1%CVE-2021-22795CRITICALA CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause reEPSS 3.1%CVE-2022-48107CRITICALD-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vEPSS 3.1%CVE-2022-48108CRITICALD-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This EPSS 3.1%CVE-2026-17179HIGHIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 3.1%CVE-2012-10059CRITICALDolibarr ERP/CRM Post-Auth OS Command InjectionEPSS 3.1%CVE-2022-22984MEDIUMCommand InjectionEPSS 3.1%