Fallos del tipo CWE-78

4594 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-10873HIGHShibby Tomato Web UI rstats rstats_path os command injectionEPSS 2.7%CVE-2025-65008CRITICALOS Command Injection in WODESYS WD-R608U routerEPSS 2.7%CVE-2021-21876CRITICALSpecially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests toEPSS 2.7%CVE-2021-21877CRITICALSpecially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests EPSS 2.7%CVE-2018-25083CRITICALThe pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.EPSS 2.7%CVE-2023-26921CRITICALOS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.EPSS 2.7%CVE-2022-42999HIGHD-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /gEPSS 2.7%CVE-2026-7256HIGH** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 coEPSS 2.7%CVE-2024-5181CRITICALCommand Injection in mudler/localaiEPSS 2.7%CVE-2025-35027HIGHUnitree Multiple Robotic Products Command InjectionEPSS 2.7%CVE-2024-4343CRITICALPython Command Injection in imartinez/privategptEPSS 2.7%CVE-2025-1546MEDIUMBDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injectionEPSS 2.7%CVE-2026-15495MEDIUMSonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injectionEPSS 2.7%CVE-2026-24841CRITICALDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket EndpointEPSS 2.7%CVE-2021-33721—A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elementEPSS 2.7%CVE-2025-55037CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.EPSS 2.7%CVE-2026-22225HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0EPSS 2.7%CVE-2026-58452HIGHJAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC EndpointEPSS 2.7%CVE-2011-2195—A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoEPSS 2.7%CVE-2022-24393HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.7%