Falhas do tipo CWE-78
4.566 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2025-5447MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injectionEPSS 33.2%CVE-2024-12986MEDIUMDrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injectionEPSS 32.8%CVE-2024-20356HIGHA vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote aEPSS 32.7%CVE-2025-34143CRITICALETQ Reliance CG Authentication Bypass via Trailing Space RCEEPSS 32.7%CVE-2026-73570HIGHA remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installedEPSS 32.4%KEVCVE-2020-7357CRITICALCayin CMS Command InjectionEPSS 32.1%CVE-2024-0778HIGHUniview ISC 2500-S VM.php setNatConfig os command injectionEPSS 32.1%CVE-2023-38886—An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.EPSS 31.7%CVE-2020-12513HIGHPepper+Fuchs Comtrol IO-Link Master OS Command InjectionEPSS 31.1%CVE-2023-25279CRITICALOS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.EPSS 31.0%CVE-2023-6612MEDIUMTotolink X5000R cstecgi.cgi setWizardCfg os command injectionEPSS 30.7%CVE-2022-20964MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to injEPSS 30.6%CVE-2023-7002HIGHBackup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via urlEPSS 30.6%CVE-2022-2486HIGHWAVLINK WN535K2/WN535K3 os command injectionEPSS 30.5%CVE-2024-51151HIGHD-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.EPSS 30.4%CVE-2019-5128CRITICALA command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. ExploitableEPSS 30.2%CVE-2024-22836CRITICALAn OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing EPSS 30.0%CVE-2024-12847CRITICALNETGEAR DGN setup.cgi OS Command InjectionEPSS 29.9%CVE-2023-4474CRITICALThe improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmwareEPSS 29.7%CVE-2017-5173—An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0EPSS 29.6%