Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2023-6901HIGHcodelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injectionEPSS 2.9%CVE-2026-58459HIGHgpsd gpsprof Command Injection via gnuplot plot title subtype fieldEPSS 2.9%CVE-2025-66211CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script FilenameEPSS 2.9%CVE-2022-21129HIGHVersions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exporEPSS 2.9%CVE-2025-66210CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database ImportEPSS 2.9%CVE-2024-4965MEDIUMD-Link DAR-7000-40 resmanage.php os command injectionEPSS 2.9%CVE-2026-8153CRITICALCommand injection in Dashboard Server interfaceEPSS 2.9%CVE-2018-6342CRITICALreact-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoEPSS 2.8%CVE-2025-56077HIGHOS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST requEPSS 2.8%CVE-2025-56079HIGHOS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a craEPSS 2.8%CVE-2025-56089HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.8%CVE-2025-34093HIGHPolycom HDX Series Telnet Command Injection via lan tracerouteEPSS 2.8%CVE-2026-101214HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.8%CVE-2026-86379HIGHDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1EPSS 2.8%CVE-2026-101210HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.8%CVE-2022-41942HIGHSourcegraph vulnerable to Comand Injection via gitserverEPSS 2.8%CVE-2021-37912CRITICALHGiga OAKlouds - Command Injection-1EPSS 2.8%CVE-2021-37913CRITICALHGiga OAKlouds - Command Injection-2EPSS 2.8%CVE-2022-38547HIGHA post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPNEPSS 2.8%CVE-2022-37337CRITICALA command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTPEPSS 2.8%