Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-82794HIGHSolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OEPSS 1.9%CVE-2026-82777HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulEPSS 1.9%CVE-2026-70374HIGHHashBrown CMS - OS Command Injection in Media Upload Thumbnail GenerationEPSS 1.9%CVE-2026-78037HIGHXiiaozet LK100W OS Command InjectionEPSS 1.9%CVE-2021-43928CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving compoEPSS 1.9%CVE-2026-100896CRITICALTOTOLINK N150RT Web Management formWlSiteSurvey system os command injectionEPSS 1.9%CVE-2026-113390CRITICALDrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectionEPSS 1.9%CVE-2026-80145CRITICALLantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordEPSS 1.9%CVE-2023-7311CRITICALBYTEVALUE Intelligent Flow Control Router Command InjectionEPSS 1.9%CVE-2024-6247MEDIUMWyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-6115CRITICALTotolink A7100RU CGI cstecgi.cgi setAppCfg os command injectionEPSS 1.9%CVE-2026-5995CRITICALTotolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injectionEPSS 1.9%CVE-2026-6138CRITICALTotolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injectionEPSS 1.9%CVE-2026-6139CRITICALTotolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injectionEPSS 1.9%CVE-2026-6154CRITICALTotolink A7100RU CGI cstecgi.cgi setWizardCfg os command injectionEPSS 1.9%CVE-2026-6131CRITICALTotolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injectionEPSS 1.9%CVE-2024-5241MEDIUMHuashi Private Cloud CDN Live Streaming Acceleration Server ipconfig_new.php os command injectionEPSS 1.9%CVE-2026-6156CRITICALTotolink A7100RU CGI cstecgi.cgi setIpQosRules os command injectionEPSS 1.9%CVE-2026-5996CRITICALTotolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionEPSS 1.9%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%