Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-44882CRITICALA command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary coEPSS 1.9%CVE-2026-16865HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 1.9%CVE-2022-37897CRITICALThere is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets desEPSS 1.9%CVE-2024-8075MEDIUMTOTOLINK AC1200 T8 setDiagnosisCfg os command injectionEPSS 1.9%CVE-2022-3226HIGHAn OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older thanEPSS 1.9%CVE-2026-81942HIGHPLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web ServerEPSS 1.9%CVE-2021-20017—A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobodEPSS 1.9%CVE-2026-15495MEDIUMSonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injectionEPSS 1.9%CVE-2019-25289HIGHINIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command ExecutionEPSS 1.9%CVE-2024-24622HIGHSoftaculous Webuzo Password Reset Command InjectionEPSS 1.9%CVE-2024-24623HIGHSoftaculous Webuzo FTP Management Command InjectionEPSS 1.9%CVE-2022-43184CRITICALD-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.EPSS 1.9%CVE-2026-9772HIGHUnraid Web Server FileUpload Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-9773HIGHUnraid Web Server ToggleState Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-5802MEDIUMidachev mcp-javadc HTTP os command injectionEPSS 1.9%CVE-2025-45491CRITICALLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the usernaEPSS 1.9%CVE-2023-1997HIGHOS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xEPSS 1.9%CVE-2024-31705CRITICALAn issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of usEPSS 1.9%CVE-2025-34056CRITICALAVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionEPSS 1.9%CVE-2026-105106HIGHKoha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled taskEPSS 1.9%