Falhas do tipo CWE-78
4.646 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2025-10265HIGHDigiever｜NVR - OS Command InjectionEPSS 1.1%CVE-2023-44427HIGHD-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-11408MEDIUMvertex-app vertex Log Viewer Endpoint LogMod.js os command injectionEPSS 1.1%CVE-2022-35845HIGHMultiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester EPSS 1.1%CVE-2023-44421HIGHD-Link DIR-X3260 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-44423HIGHD-Link DIR-X3260 SetTriggerPPPoEValidate Password Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-44422HIGHD-Link DIR-X3260 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-44426HIGHD-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-44424HIGHD-Link DIR-X3260 SetSysEmailSettings EmailTo Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-44425HIGHD-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-47562HIGHPhoto StationEPSS 1.1%CVE-2023-33869MEDIUMEnphase Envoy OS Command InjectionEPSS 1.1%CVE-2025-26055MEDIUMAn OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter oEPSS 1.1%CVE-2023-26317HIGHXiaomi router external request interface has command injectionEPSS 1.1%CVE-2023-53945HIGHBrainyCP 1.0 Remote Code Execution via Authenticated Crontab ManipulationEPSS 1.1%CVE-2023-44403HIGHD-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-51661CRITICALWordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerabilityEPSS 1.1%CVE-2024-43405HIGHNuclei Template Signature Verification BypassEPSS 1.1%CVE-2024-31408HIGHOS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbiEPSS 1.1%CVE-2023-47567MEDIUMQTS, QuTS hero, QuTScloudEPSS 1.1%