Fallos del tipo CWE-78

4592 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-11202CRITICALwin-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution VulnerabilityEPSS 2.8%CVE-2026-19682CRITICALCommand InjectionEPSS 2.8%CVE-2022-35132HIGHUsermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.EPSS 2.8%CVE-2021-37912CRITICALHGiga OAKlouds - Command Injection-1EPSS 2.8%CVE-2021-37913CRITICALHGiga OAKlouds - Command Injection-2EPSS 2.8%CVE-2026-5663MEDIUMOFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injectionEPSS 2.8%CVE-2022-38547HIGHA post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPNEPSS 2.8%CVE-2022-37337CRITICALA command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTPEPSS 2.8%CVE-2026-75616HIGHCommand Injection in Router Web Management InterfaceEPSS 2.8%CVE-2025-34335HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.phpEPSS 2.8%CVE-2013-10049CRITICALRaidsonic NAS Devices Unauthenticated Remote Command ExecutionEPSS 2.8%CVE-2026-3102MEDIUMexiftool PNG File MacOS.pm SetMacOSTags os command injectionEPSS 2.8%CVE-2019-1634HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 2.8%CVE-2025-59360CRITICALOS command injection in Chaos Mesh via the killProcesses mutationEPSS 2.8%CVE-2021-36295HIGHDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious userEPSS 2.8%CVE-2021-36296HIGHDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious userEPSS 2.8%CVE-2023-50651CRITICALTOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cEPSS 2.8%CVE-2020-12775CRITICALHicos citizen certificate client-side component - Command InjectionEPSS 2.8%CVE-2026-73680HIGHCockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameEPSS 2.8%CVE-2026-34599HIGHCoolify: Authenticated Remote Code Execution in GetLogs Livewire ComponentEPSS 2.8%