Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2022-30310CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.7%CVE-2026-121931CRITICALLinksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injectionEPSS 2.7%CVE-2026-121930CRITICALLinksys WRT54GL Ping Diagnostic apply.cgi system os command injectionEPSS 2.7%CVE-2022-30311CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.7%CVE-2026-7698MEDIUMTiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injectionEPSS 2.7%CVE-2019-7198—Command Injection Vulnerability in QTS and QuTS heroEPSS 2.7%CVE-2025-34054CRITICALAVTECH IP camera, DVR, and NVR Devices Unauthenticated Command InjectionEPSS 2.7%CVE-2021-1560MEDIUMCisco DNA Spaces Connector Command Injection VulnerabilitiesEPSS 2.7%CVE-2021-1559MEDIUMCisco DNA Spaces Connector Command Injection VulnerabilitiesEPSS 2.7%CVE-2021-29083HIGHImproper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.EPSS 2.7%CVE-2026-91913HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.7%CVE-2026-73693HIGHFileRun < 2026.3.0 OS Command Injection via PhotoProofSheet HandlerEPSS 2.7%CVE-2021-32751HIGHArbitrary code execution via specially crafted environment variablesEPSS 2.7%CVE-2019-10956—Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote auEPSS 2.7%CVE-2024-49380HIGHPlenti arbitrary file write vulnerabilityEPSS 2.7%CVE-2026-12851CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-12849CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-71961HIGHCudy WR3000 2.0 OS Command Injection via Mesh MQTT Command HandlerEPSS 2.7%CVE-2026-12486CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-12850CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%