Fallos del tipo CWE-78

4599 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2011-10026CRITICALSpreecommerce < 0.50.x API RCEEPSS 2.6%CVE-2025-49537HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%CVE-2026-10872HIGHShibby Tomato Web UI rc start_vpnserver os command injectionEPSS 2.6%CVE-2026-35196HIGHChamilo LMS has OS Command Injection via export_all_certificates actionEPSS 2.6%CVE-2025-1244HIGHEmacs: shell injection vulnerability in gnu emacs via custom "man" uri schemeEPSS 2.6%CVE-2025-6897MEDIUMD-Link DI-7300G+ httpd_debug.asp os command injectionEPSS 2.6%CVE-2019-1864HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 2.6%CVE-2022-30311CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.6%CVE-2022-30310CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.6%CVE-2021-29083HIGHImproper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.EPSS 2.6%CVE-2021-47728CRITICALSelea Targa IP Camera Remote Code Execution via UtilsEPSS 2.6%CVE-2026-8450CRITICALHTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()EPSS 2.6%CVE-2020-36867HIGHNagios XI < 5.7.3 Command Injection in Report PDF DownloadEPSS 2.6%CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2021-36287HIGHDell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticEPSS 2.6%CVE-2026-26832CRITICALnode-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() functEPSS 2.6%CVE-2025-50194HIGHChamilo: OS Command Injection in /main/cron/lang/check_parse_lang.phpEPSS 2.6%CVE-2026-65091HIGHNVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploitEPSS 2.6%CVE-2026-9347MEDIUMEdimax EW-7438RPn webs formWizSurvey os command injectionEPSS 2.6%CVE-2025-50193HIGHChamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameterEPSS 2.6%