Fallos del tipo CWE-78

4591 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-64756HIGHglob CLI: Command injection via -c/--cmd executes matches with shell:trueEPSS 3.1%CVE-2024-7171MEDIUMTOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injectionEPSS 3.1%CVE-2024-7175MEDIUMTOTOLINK A3600R cstecgi.cgi setDiagnosisCfg os command injectionEPSS 3.1%CVE-2024-8574MEDIUMTOTOLINK AC1200 T8 cstecgi.cgi setParentalRules os command injectionEPSS 3.1%CVE-2026-30815HIGHOS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53EPSS 3.1%CVE-2026-9254HIGHCommand Injection Vulnerability in Parent Control of Multiple TP-Link Archer DevicesEPSS 3.1%CVE-2020-12522CRITICALCommand Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10EPSS 3.1%CVE-2025-56110HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request toEPSS 3.1%CVE-2025-56111HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request toEPSS 3.1%CVE-2025-56109HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request toEPSS 3.1%CVE-2025-56117HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 3.1%CVE-2020-2507CRITICALcommand injection vulnerability in HelpdeskEPSS 3.0%CVE-2026-36576CRITICALAn OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to exEPSS 3.0%CVE-2026-33718HIGHOpenHands is Vulnerable to Command Injection through its Git Diff HandlerEPSS 3.0%CVE-2022-3008HIGHCommand Injection on tinygltfEPSS 3.0%CVE-2026-43641CRITICALSoftaculous Virtualizor OS Command Injection via Billing Module HandlerEPSS 3.0%CVE-2021-31580HIGHAkkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' commandEPSS 3.0%CVE-2026-26046HIGHMoodle: moodle: improper input sanitization in tex filter administration settingEPSS 3.0%CVE-2026-59726CRITICALRuflo: Unauthenticated RCE in MCP bridge default docker-compose deploymentEPSS 3.0%CVE-2024-30368HIGHA10 Thunder ADC CsrRequestView Command Injection Remote Code Execution VulnerabilityEPSS 3.0%