Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-108894CRITICALLinksys E1700 Static Route addStaticRoute os command injectionEPSS 2.2%CVE-2024-48635HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID paramEPSS 2.1%CVE-2024-48629HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameteEPSS 2.1%CVE-2024-48638HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parametEPSS 2.1%CVE-2026-16348HIGHCommand Injection Vulnerability in VPN connection of Archer BE800EPSS 2.1%CVE-2024-48637HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID paramEPSS 2.1%CVE-2024-48636HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID paramEPSS 2.1%CVE-2026-63766CRITICALGPT-SoVITS 20250606v2pro OS Command Injection via webui.pyEPSS 2.1%CVE-2024-48631HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in EPSS 2.1%CVE-2023-35762CRITICALOS Command Injection in INEA ME RTUEPSS 2.1%CVE-2024-45887HIGHDrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameEPSS 2.1%CVE-2024-45884HIGHDrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameEPSS 2.1%CVE-2024-45890HIGHDrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parametEPSS 2.1%CVE-2025-2773HIGHBEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution VulnerabilityEPSS 2.1%CVE-2021-33534HIGHWEIDMUELLER: WLAN devices affected by OS Command Injection vulnerabilityEPSS 2.1%CVE-2026-5547MEDIUMTenda AC10 httpd formAddMacfilterRule os command injectionEPSS 2.1%CVE-2026-3037HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-20764HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%CVE-2026-9543CRITICALTotolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injectionEPSS 2.1%CVE-2024-2162HIGHAuthenticated Remote Code Execution in Kiloview NDI N series productsEPSS 2.1%