Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2024-50567MEDIUMAn improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allowEPSS 2.2%CVE-2026-108895CRITICALLinksys E1700 setDMZ os command injectionEPSS 2.2%CVE-2016-10541—The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications thatEPSS 2.2%CVE-2026-10871HIGHShibby Tomato Web UI rc start_6rd_tunnel os command injectionEPSS 2.2%CVE-2026-10870HIGHShibby Tomato Web UI rc start_dhcpc os command injectionEPSS 2.2%CVE-2026-5977CRITICALTotolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionEPSS 2.2%CVE-2026-28269MEDIUMKiteworks Core has an OS Command InjectionEPSS 2.2%CVE-2025-56107HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 2.2%CVE-2026-73172CRITICALNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraEPSS 2.2%CVE-2023-26155HIGHAll versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize EPSS 2.2%CVE-2022-42496CRITICALOS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to EPSS 2.2%CVE-2022-41642CRITICALOS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS commandEPSS 2.2%CVE-2026-106126CRITICALCommand InjectionEPSS 2.2%CVE-2025-9972CRITICALPlanet Technology｜Industrial Cellular Gateway - OS Command InjectionEPSS 2.2%CVE-2026-86394HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 2.2%CVE-2026-86399HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 2.2%CVE-2026-86395HIGHDell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.EPSS 2.2%CVE-2026-50289HIGHsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on LinuxEPSS 2.2%CVE-2026-82678MEDIUMdiem-project diem Administrative Console actions.class.php executeCommand os command injectionEPSS 2.2%CVE-2026-90788MEDIUMmagicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injectionEPSS 2.2%