Falhas do tipo CWE-78
4.568 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2019-5475—The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnEPSS 18.4%CVE-2025-9424MEDIUMRuijie WS7204-A branch_import.php os command injectionEPSS 18.3%CVE-2022-42139HIGHDelta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL.EPSS 18.2%CVE-2023-34993CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 18.1%CVE-2025-54987CRITICALA vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious EPSS 18.1%CVE-2023-5683MEDIUMByzoro Smart S85F Management Platform importconf.php os command injectionEPSS 18.0%CVE-2024-13129HIGHRoxy-WI roxy.py action_service os command injectionEPSS 17.8%CVE-2024-48634HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in tEPSS 17.6%CVE-2023-29804HIGHWFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function.EPSS 17.5%CVE-2020-4006CRITICALVMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerabiliEPSS 17.3%KEVCVE-2020-7361CRITICALZenTao Pro Command InjectionEPSS 17.2%CVE-2025-47228MEDIUMIn the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows aEPSS 17.2%CVE-2025-53949HIGHAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinEPSS 17.2%CVE-2022-40624CRITICALpfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different EPSS 17.1%CVE-2013-10048CRITICALD-Link Devices command.php Unauthenticated RCEEPSS 17.1%CVE-2025-7082MEDIUMBelkin F9K1122 webs formBSSetSitesurvey os command injectionEPSS 16.9%CVE-2025-14092MEDIUMEdimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injectionEPSS 16.9%CVE-2025-6770HIGHOS command injection in Ivanti Endpoint ManagerEPSS 16.8%CVE-2024-9004MEDIUMD-Link DAR-7000 Backup_Server_commit.php os command injectionEPSS 16.6%CVE-2026-5854CRITICALTotolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionEPSS 16.6%