Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-51123CRITICALAn issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the seEPSS 24.4%CVE-2024-46658HIGHSyrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.EPSS 24.4%CVE-2024-4884CRITICALWhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 24.3%CVE-2025-32821HIGHA vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell comEPSS 23.5%CVE-2024-7467MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injectionEPSS 23.4%CVE-2024-5411HIGHCommand InjectionEPSS 23.4%CVE-2026-0652HIGHRemote Code Execution on TP-Link Tapo C260 by Guest UserEPSS 23.3%CVE-2025-47228MEDIUMIn the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows aEPSS 23.1%CVE-2025-6771HIGHOS command injection in Ivanti Endpoint ManagerEPSS 23.0%CVE-2024-9977MEDIUMMitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injectionEPSS 22.9%CVE-2023-27076CRITICALCommand injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.EPSS 22.9%CVE-2024-40891HIGH**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VEPSS 22.9%KEVCVE-2025-15472HIGHTRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injectionEPSS 22.4%CVE-2024-47908CRITICALOS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilegeEPSS 22.3%CVE-2023-33381HIGHA command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0EPSS 22.2%CVE-2023-4873MEDIUMByzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php os command injectionEPSS 22.1%CVE-2025-50121CRITICALA CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulnerability exists that could cause uEPSS 22.1%CVE-2019-25224CRITICALWP Database Backup < 5.2 - Unauthenticated OS Command InjectionEPSS 22.1%CVE-2023-2479CRITICALOS Command Injection in appium/appium-desktopEPSS 22.0%CVE-2022-45942HIGHA Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.EPSS 22.0%