Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-27549HIGHCommand Injection in /index.php/attached_devices_tab/do_uploadEPSS 2.9%CVE-2026-27547HIGHCommand Injection in /index.php/ajax/get_iodd_menu_infoEPSS 2.9%CVE-2026-27554HIGHCommand Injection in /index.php/ajax/save_iodd_parametersEPSS 2.9%CVE-2014-0156—Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argumentEPSS 2.9%CVE-2025-59360CRITICALOS command injection in Chaos Mesh via the killProcesses mutationEPSS 2.9%CVE-2025-56091HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crEPSS 2.9%CVE-2025-56086HIGHOS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitraEPSS 2.9%CVE-2025-56090HIGHOS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary cEPSS 2.9%CVE-2020-5352HIGHDell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may EPSS 2.9%CVE-2022-27003HIGHTotolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabilEPSS 2.9%CVE-2022-27004HIGHTotolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabilEPSS 2.9%CVE-2024-3739MEDIUMcym1102 nginxWebUI upload os command injectionEPSS 2.9%CVE-2026-58146CRITICALUnauthorized remote code execution in T-Mobile 5G Box IDU routersEPSS 2.9%CVE-2021-21819CRITICALA code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network rEPSS 2.9%CVE-2026-86152CRITICALTenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injectionEPSS 2.9%CVE-2024-2029CRITICALCommand Injection in mudler/localaiEPSS 2.9%CVE-2025-71429CRITICALGPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.pyEPSS 2.9%CVE-2026-82702MEDIUMEdimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injectionEPSS 2.9%CVE-2026-82703MEDIUMEdimax BR-6214K asp_setPing Endpoint ping.asp system os command injectionEPSS 2.9%CVE-2026-38820HIGHopenNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on EPSS 2.9%