Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2022-44930CRITICALD-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.EPSS 2.6%CVE-2022-24394HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.6%CVE-2026-87666HIGHAn OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.EPSS 2.6%CVE-2025-56098HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 2.6%CVE-2025-56118HIGHOS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands viaEPSS 2.6%CVE-2025-56114HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.6%CVE-2025-1339MEDIUMTOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injectionEPSS 2.6%CVE-2025-56102HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crEPSS 2.6%CVE-2025-56097HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands EPSS 2.6%CVE-2023-28102HIGHCommand injection in discordrbEPSS 2.6%CVE-2026-71914CRITICALDrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apmEPSS 2.6%CVE-2026-2686CRITICALSECCN Dingcheng G10 session_login.cgi qq os command injectionEPSS 2.6%CVE-2025-63911HIGHCohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability.EPSS 2.6%CVE-2026-5974MEDIUMFoundationAgents MetaGPT terminal.py Bash.run os command injectionEPSS 2.6%CVE-2026-11739MEDIUMCommand injection vulnerability in some NETGEAR Nighthawk devicesEPSS 2.5%CVE-2020-36867HIGHNagios XI < 5.7.3 Command Injection in Report PDF DownloadEPSS 2.5%CVE-2026-6027CRITICALTotolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injectionEPSS 2.5%CVE-2022-40785HIGHUnsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gEPSS 2.5%CVE-2022-1813HIGHOS Command Injection in yogeshojha/rengineEPSS 2.5%CVE-2024-43804HIGHOS Command Injection via Port Scan Functionality in Roxy-WIEPSS 2.5%