Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2023-2522MEDIUMChengdu VEC40G Network Detection os command injectionEPSS 33.7%CVE-2022-2488HIGHWAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injectionEPSS 33.4%CVE-2024-12828CRITICALWebmin CGI Command Injection Remote Code Execution VulnerabilityEPSS 33.3%CVE-2017-6884HIGHA command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is locateEPSS 33.0%KEVCVE-2025-54948CRITICALA vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious EPSS 32.9%KEVCVE-2024-12686MEDIUMCommand Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)EPSS 32.6%KEVCVE-2025-5447MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injectionEPSS 32.6%CVE-2021-3060HIGHPAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)EPSS 32.5%CVE-2020-7357CRITICALCayin CMS Command InjectionEPSS 32.1%CVE-2024-0778HIGHUniview ISC 2500-S VM.php setNatConfig os command injectionEPSS 32.1%CVE-2025-54136HIGHCursor's Modification of MCP Server Definitions Bypasses Manual Re-approvalsEPSS 31.5%CVE-2024-51151HIGHD-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.EPSS 31.2%CVE-2020-12513HIGHPepper+Fuchs Comtrol IO-Link Master OS Command InjectionEPSS 31.1%CVE-2023-25279CRITICALOS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.EPSS 31.0%CVE-2025-34036CRITICALShenzhen TVT CCTV-DVR Command InjectionEPSS 30.9%CVE-2023-7002HIGHBackup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via urlEPSS 30.8%CVE-2023-6612MEDIUMTotolink X5000R cstecgi.cgi setWizardCfg os command injectionEPSS 30.7%CVE-2022-20964MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to injEPSS 30.6%CVE-2024-12847CRITICALNETGEAR DGN setup.cgi OS Command InjectionEPSS 30.4%CVE-2022-2486HIGHWAVLINK WN535K2/WN535K3 os command injectionEPSS 30.2%