Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-32937HIGHAn os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1EPSS 27.0%CVE-2023-32150MEDIUMD-Link DIR-2640 PrefixLen Command Injection Remote Code Execution VulnerabilityEPSS 26.9%CVE-2023-32153MEDIUMD-Link DIR-2640 EmailFrom Command Injection Remote Code Execution VulnerabilityEPSS 26.9%CVE-2024-27172CRITICALRemote Code ExecutionEPSS 26.8%CVE-2023-5684MEDIUMByzoro Smart S85F Management Platform importexport.php os command injectionEPSS 26.6%CVE-2025-34227HIGHNagios XI < 2026R1 Configuration Wizard Authenticated Command InjectionEPSS 26.5%CVE-2025-58180HIGHOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File UploadEPSS 26.1%CVE-2025-27364CRITICALIn MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implantEPSS 25.9%CVE-2023-30013CRITICALTOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. ThiEPSS 25.9%CVE-2013-10059HIGHD-Link Routers tools_vct.htm OS Command InjectionEPSS 25.9%CVE-2024-0918HIGHTRENDnet TEW-800MB POST Request os command injectionEPSS 25.4%CVE-2022-32572CRITICALAn os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 25.3%CVE-2022-36309—Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter ofEPSS 25.2%CVE-2024-7470MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn_template_style.php sslvpn_config_mod os command injectionEPSS 24.9%CVE-2024-7469MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injectionEPSS 24.9%CVE-2024-7468MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injectionEPSS 24.9%CVE-2025-34035CRITICALEnGenius EnShare IoT Gigabit Cloud Service Command InjectionEPSS 24.8%CVE-2012-5863—Sinapsi eSolar OS Command InjectionEPSS 24.8%CVE-2025-43984CRITICALAn issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are EPSS 24.8%CVE-2021-3708—D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the loEPSS 24.6%