Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2023-42120HIGHControl Web Panel dns_zone_editor Command Injection Remote Code Execution VulnerabilityEPSS 2.6%CVE-2019-1864HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 2.6%CVE-2026-105425HIGHOS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.EPSS 2.6%CVE-2021-47728CRITICALSelea Targa IP Camera Remote Code Execution via UtilsEPSS 2.6%CVE-2022-25923HIGHVersions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper uEPSS 2.6%CVE-2021-36287HIGHDell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticEPSS 2.6%CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2026-5973MEDIUMFoundationAgents MetaGPT common.py get_mime_type os command injectionEPSS 2.6%CVE-2025-59834CRITICALCommand Injection in adb-mcp MCP ServerEPSS 2.6%CVE-2026-65091HIGHNVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploitEPSS 2.6%CVE-2025-6104HIGHWifi-soft UniBox Controller pms_check.php os command injectionEPSS 2.6%CVE-2026-2560MEDIUMkalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injectionEPSS 2.6%CVE-2025-30286HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%CVE-2022-42999HIGHD-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /gEPSS 2.6%CVE-2020-25847HIGHCommand Injection Vulnerability in QTS and QuTS heroEPSS 2.6%CVE-2020-37027CRITICALSickbeard 0.1 - Remote Command InjectionEPSS 2.6%CVE-2026-85672CRITICALzerox 1.1.20 OS Command Injection via Document URL File ExtensionEPSS 2.6%CVE-2026-16766CRITICALCatalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render optionsEPSS 2.6%CVE-2026-85696CRITICALSadTalker OS Command Injection via Audio FilenameEPSS 2.6%CVE-2020-7805—An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command inEPSS 2.6%