Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-2131MEDIUMXixianLiang HarmonyOS-mcp-server input_text os command injectionEPSS 17.2%CVE-2020-7361CRITICALZenTao Pro Command InjectionEPSS 17.2%CVE-2025-48047CRITICALMICI Network Co. Ltd. NetFax Server Command InjectionEPSS 17.2%CVE-2022-2314—VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function CallEPSS 17.2%CVE-2025-14092MEDIUMEdimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injectionEPSS 16.9%CVE-2026-5854CRITICALTotolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionEPSS 16.9%CVE-2025-53949HIGHAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinEPSS 16.8%CVE-2025-10775MEDIUMWavlink WL-NU516U1 login.cgi sub_4012A0 os command injectionEPSS 16.7%CVE-2024-9004MEDIUMD-Link DAR-7000 Backup_Server_commit.php os command injectionEPSS 16.6%CVE-2013-10048CRITICALD-Link Devices command.php Unauthenticated RCEEPSS 16.6%CVE-2013-10069CRITICALD-Link Devices Unauthenticated RCEEPSS 16.3%CVE-2018-15442HIGHCisco Webex Meetings Desktop App Update Service Command Injection VulnerabilityEPSS 16.0%CVE-2025-2605CRITICALAuthenticated command injectionEPSS 16.0%CVE-2023-29778CRITICALGL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.EPSS 16.0%CVE-2017-20215HIGHFLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command InjectionEPSS 15.8%CVE-2022-31898MEDIUMgl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the pEPSS 15.8%CVE-2025-52379MEDIUMNexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware uEPSS 15.7%CVE-2024-9054HIGHRemote code Execution inTimeProvider® 4100EPSS 15.6%CVE-2023-23596HIGHjc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with EPSS 15.6%CVE-2026-77690HIGHCommand injection vulnerabilityEPSS 15.6%