Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-71992CRITICALMSI Radix AXE6600 v781521 Command Injection via macfilterEPSS 2.5%CVE-2026-71987CRITICALMSI Radix AXE6600 v781521 Command Injection via alg functionEPSS 2.5%CVE-2026-27190HIGHDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processEPSS 2.5%CVE-2022-46538CRITICALTenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac.EPSS 2.5%CVE-2020-36856CRITICALNagios XI < 5.6.14 Authenticated RCE command_test.php via addressEPSS 2.5%CVE-2026-7242CRITICALTotolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injectionEPSS 2.5%CVE-2026-18199HIGHRemote Code Execution VulnerabilityEPSS 2.5%CVE-2026-120277CRITICALWAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injectionEPSS 2.5%CVE-2026-65086MEDIUMNVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A suEPSS 2.4%CVE-2026-45322HIGHOS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSONEPSS 2.4%CVE-2026-7203CRITICALTotolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injectionEPSS 2.4%CVE-2026-7202CRITICALTotolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injectionEPSS 2.4%CVE-2026-7241CRITICALTotolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionEPSS 2.4%CVE-2026-7243CRITICALTotolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injectionEPSS 2.4%CVE-2026-7204CRITICALTotolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injectionEPSS 2.4%CVE-2023-22643MEDIUMlibzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` callsEPSS 2.4%CVE-2025-41709CRITICALCommand injection in power analyzer via Modbus-TCP and Modbus-RTUEPSS 2.4%CVE-2022-28495CRITICALTOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via EPSS 2.4%CVE-2026-22781CRITICALTinyWeb CGI Command InjectionEPSS 2.4%CVE-2020-8273—Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8.EPSS 2.4%