Fallos del tipo CWE-78

4602 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-34049CRITICALOptiLink ONT1GEW GPON Remote Code ExecutionEPSS 2.4%CVE-2020-8273—Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8.EPSS 2.4%CVE-2025-56087HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 2.4%CVE-2022-50909HIGHAlgo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)EPSS 2.4%CVE-2021-21954CRITICALA command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 EPSS 2.4%CVE-2023-3991CRITICALOS command injection vulnerability in FreshTomato 2023.3EPSS 2.4%CVE-2026-67608HIGHTelenia TVox 26.5.3 OS Command Injection via action_audio.phpEPSS 2.4%CVE-2026-67599HIGHClearOS 7.9 OS Command Injection via Log Viewer filter parameterEPSS 2.4%CVE-2021-21302MEDIUMCSV Injection via csv exportEPSS 2.4%CVE-2026-40520HIGHFreePBX api module Command Injection via GraphQLEPSS 2.4%CVE-2026-32833HIGHCudy LT300 3.0 OS Command Injection via NTP ConfigurationEPSS 2.4%CVE-2025-1676MEDIUMhzmanyun Education and Training System pdf2swf os command injectionEPSS 2.4%CVE-2022-25171HIGHCommand InjectionEPSS 2.4%CVE-2026-66297MEDIUMUnescaped deployment environment variables in generated setup commandsEPSS 2.4%CVE-2026-90492MEDIUMwebgjc web_robot web.py controller_recover os command injectionEPSS 2.4%CVE-2026-85542HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 2.4%CVE-2025-64126CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.4%CVE-2025-64128CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.4%CVE-2025-64127CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.4%CVE-2023-40505CRITICALLG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution VulnerabilityEPSS 2.4%