Falhas do tipo CWE-78
4.564 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-51572CRITICALVoltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution VulnerabilityEPSS 38.4%CVE-2023-39367CRITICALAn OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specialEPSS 37.7%CVE-2024-0921MEDIUMD-Link DIR-816 A2 Web Interface setDeviceSettings os command injectionEPSS 37.6%CVE-2019-11001HIGHOn Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionEPSS 37.5%KEVCVE-2019-15978HIGHCisco Data Center Network Manager Command Injection VulnerabilitiesEPSS 37.5%CVE-2021-47667CRITICALAn OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackeEPSS 36.6%CVE-2021-21881CRITICALAn OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0EPSS 36.2%CVE-2022-0848CRITICALOS Command Injection in part-db/part-dbEPSS 35.4%CVE-2024-45242HIGHEnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping oEPSS 35.4%CVE-2022-40005HIGHIntelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 EPSS 35.0%CVE-2022-45025CRITICALMarkdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF filEPSS 34.8%CVE-2017-6884HIGHA command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is locateEPSS 34.4%KEVCVE-2025-28137CRITICALThe TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg functEPSS 34.1%CVE-2023-37569HIGHOS Command Injection Vulnerability in Emagic Data Center Management SuiteEPSS 33.9%CVE-2021-3060HIGHPAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)EPSS 33.9%CVE-2022-2488HIGHWAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injectionEPSS 33.8%CVE-2023-2522MEDIUMChengdu VEC40G Network Detection os command injectionEPSS 33.7%CVE-2025-9377HIGHAuthenticated RCE via Parental Control command injectionEPSS 33.5%KEVCVE-2024-12828CRITICALWebmin CGI Command Injection Remote Code Execution VulnerabilityEPSS 33.5%CVE-2020-2509CRITICALCommand Injection Vulnerability in QTS and QuTS heroEPSS 33.4%KEV