Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2022-25860HIGHVersions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemotEPSS 2.8%CVE-2026-75616HIGHCommand Injection in Router Web Management InterfaceEPSS 2.8%CVE-2026-120229CRITICALWAVLINK WN553X1-B ioos sub_416B50 os command injectionEPSS 2.8%CVE-2022-48252CRITICALThe jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command InjectioEPSS 2.8%CVE-2025-34335HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.phpEPSS 2.8%CVE-2022-35132HIGHUsermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.EPSS 2.8%CVE-2025-34112CRITICALRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCEEPSS 2.8%CVE-2022-44019HIGHIn Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.EPSS 2.8%CVE-2019-1634HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 2.8%CVE-2005-10004HIGHCacti graph_view.php RCE via graph_start Parameter InjectionEPSS 2.8%CVE-2021-23031—On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x befoEPSS 2.8%CVE-2021-36296HIGHDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious userEPSS 2.8%CVE-2021-36295HIGHDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious userEPSS 2.8%CVE-2023-50651CRITICALTOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cEPSS 2.8%CVE-2026-73680HIGHCockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameEPSS 2.8%CVE-2020-12775CRITICALHicos citizen certificate client-side component - Command InjectionEPSS 2.8%CVE-2026-34599HIGHCoolify: Authenticated Remote Code Execution in GetLogs Livewire ComponentEPSS 2.8%CVE-2019-5140HIGHAn exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially cEPSS 2.8%CVE-2026-124580CRITICALChengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injectionEPSS 2.8%CVE-2026-24841CRITICALDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket EndpointEPSS 2.8%