Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2020-9377HIGHD-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products tEPSS 21.9%KEVCVE-2023-34993CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 21.3%CVE-2025-10242HIGHOS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeEPSS 21.3%CVE-2025-10243HIGHOS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeEPSS 21.3%CVE-2025-10985HIGHOS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeEPSS 21.3%CVE-2025-67038CRITICALLantronix EDS5000, G520, and X300 OS Command InjectionEPSS 21.1%KEVCVE-2023-0830MEDIUMEasyNAS backup.pl system os command injectionEPSS 20.9%CVE-2024-9076MEDIUMDedeCMS article_string_mix.php os command injectionEPSS 20.8%CVE-2025-34117CRITICALNetcore / Netis Routers RCE via UDP Port 53413 BackdoorEPSS 20.8%CVE-2024-40890HIGH**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-BEPSS 20.7%KEVCVE-2025-7081MEDIUMBelkin F9K1122 webs formSetWanStatic os command injectionEPSS 20.4%CVE-2026-36356CRITICALThe GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injecEPSS 20.3%CVE-2024-24576CRITICALRusts's `std::process::Command` did not properly escape arguments of batch files on WindowsEPSS 20.3%CVE-2025-14094MEDIUMEdimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injectionEPSS 20.3%CVE-2022-45711CRITICALIP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckTEPSS 20.2%CVE-2025-3002MEDIUMDigital China DCME-520 mon_merge_stat_hist.php os command injectionEPSS 20.0%CVE-2025-32778CRITICALWeb-Check allows command Injection via Unvalidated URL in Screenshot APIEPSS 19.9%CVE-2026-25512CRITICALGroup-Office is vulnerable to RCE due to Command Injection via TNEF Attachment HandlerEPSS 19.9%CVE-2025-66398CRITICALSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)EPSS 19.9%CVE-2023-51385MEDIUMIn ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is refereEPSS 19.8%