Falhas do tipo CWE-78
4.664 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-16865HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.7%CVE-2026-72733CRITICALDokploy: OS Command Injection via `databaseName` / `backupFile` in database restoreEPSS 0.7%CVE-2026-17347HIGHpgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutionEPSS 0.7%CVE-2024-51251HIGHIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the baEPSS 0.7%CVE-2024-20458HIGHCisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesEPSS 0.7%CVE-2023-3333—Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG18EPSS 0.7%CVE-2026-46483LOWVim: Command injection in tar#Vimuntar via missing shellescape {special} flagEPSS 0.7%CVE-2019-3595LOWDLP Endpoint ePO extension not sanitizing CSV exportsEPSS 0.7%CVE-2024-5227HIGHTP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution VulnerabilityEPSS 0.7%CVE-2021-47747HIGHmeterN 1.2.3 Authenticated Remote Code Execution via Admin ScriptsEPSS 0.7%CVE-2025-23316CRITICALNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote EPSS 0.7%CVE-2024-33368HIGHAn issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScEPSS 0.7%CVE-2026-72868CRITICALDokploy: Member-role RCE as host root via destination.testConnection rclone shell injectionEPSS 0.7%CVE-2026-72876CRITICALDokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*EPSS 0.7%CVE-2025-53623HIGHJob Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator classEPSS 0.7%CVE-2026-88274HIGHGV-LPC2011/LPC2211 - Wireless SSID Command InjectionEPSS 0.7%CVE-2026-88275HIGHGV-LPC2011/LPC2211 - Wireless WPA-PSK Command InjectionEPSS 0.7%CVE-2026-88276HIGHGV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command InjectionEPSS 0.7%CVE-2026-88273HIGHGV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command InjectionEPSS 0.7%CVE-2026-55157HIGHToken Optimizer MCP: OS command injection in smart_user via username in get-user-infoEPSS 0.7%