Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-6620MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionEPSS 2.5%CVE-2025-6621MEDIUMTOTOLINK CA300-PoE ap.so QuickSetting os command injectionEPSS 2.5%CVE-2018-1169—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User intEPSS 2.5%CVE-2025-6619MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionEPSS 2.5%CVE-2025-6618MEDIUMTOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionEPSS 2.5%CVE-2026-9347MEDIUMEdimax EW-7438RPn webs formWizSurvey os command injectionEPSS 2.5%CVE-2026-9343MEDIUMEdimax EW-7438RPn webs formWpsStart os command injectionEPSS 2.5%CVE-2025-49537HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.5%CVE-2023-36549HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2018-5553CRITICALCrestron DGE-100 Console Command Injection (FIXED)EPSS 2.5%CVE-2023-34989HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-36548CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34985HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34988HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-36547CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-36550CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34987HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2023-34986HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.5%CVE-2026-62392HIGHApache Kylin: OS Command Injection via Async Query APIEPSS 2.5%CVE-2020-3586CRITICALCisco DNA Spaces Connector Command Injection VulnerabilityEPSS 2.5%