Fallos del tipo CWE-78

4593 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-2095MEDIUMTOTOLINK EX1800T cstecgi.cgi setDmzCfg os command injectionEPSS 2.7%CVE-2022-48252CRITICALThe jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command InjectioEPSS 2.7%CVE-2026-32892CRITICALOS Command Injection in Chamilo LMS 1.11.36EPSS 2.7%CVE-2019-7198—Command Injection Vulnerability in QTS and QuTS heroEPSS 2.7%CVE-2021-1560MEDIUMCisco DNA Spaces Connector Command Injection VulnerabilitiesEPSS 2.7%CVE-2021-1559MEDIUMCisco DNA Spaces Connector Command Injection VulnerabilitiesEPSS 2.7%CVE-2022-25860HIGHVersions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemotEPSS 2.7%CVE-2026-58000HIGHluci-proto-openvpn - Command Injection via cl_meta Parameter in generateKeyEPSS 2.7%CVE-2026-73693HIGHFileRun < 2026.3.0 OS Command Injection via PhotoProofSheet HandlerEPSS 2.7%CVE-2021-32751HIGHArbitrary code execution via specially crafted environment variablesEPSS 2.7%CVE-2019-10956—Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote auEPSS 2.7%CVE-2024-49380HIGHPlenti arbitrary file write vulnerabilityEPSS 2.7%CVE-2026-12486CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-12849CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-71961HIGHCudy WR3000 2.0 OS Command Injection via Mesh MQTT Command HandlerEPSS 2.7%CVE-2022-1813HIGHOS Command Injection in yogeshojha/rengineEPSS 2.7%CVE-2026-12850CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-12851CRITICALGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityEPSS 2.7%CVE-2026-93958CRITICALD-Link R95 DHMAPI ssi system os command injectionEPSS 2.7%CVE-2025-34054CRITICALAVTECH IP camera, DVR, and NVR Devices Unauthenticated Command InjectionEPSS 2.7%