Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2026-4631CRITICALCockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injectionEPSS 15.5%CVE-2026-5850CRITICALTotolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injectionEPSS 15.4%CVE-2025-9424MEDIUMRuijie WS7204-A branch_import.php os command injectionEPSS 15.2%CVE-2024-13985CRITICALDahua EIMS capture_handle.action RCEEPSS 15.1%CVE-2026-17176HIGHOS Command Injection Vulnerability in Deco DevicesEPSS 15.0%CVE-2022-43548HIGHA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost cEPSS 14.9%CVE-2025-5571MEDIUMD-Link DCS-932L setSystemAdmin os command injectionEPSS 14.7%CVE-2025-5573MEDIUMD-Link DCS-932L setSystemWizard setSystemControl os command injectionEPSS 14.7%CVE-2024-3799HIGHShell command injection in PhonieboxEPSS 14.6%CVE-2022-20650HIGHCisco NX-OS Software NX-API Command Injection VulnerabilityEPSS 14.5%CVE-2024-53942MEDIUMAn issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command inEPSS 14.3%CVE-2023-23369CRITICALQTS, Multimedia Console, and Media Streaming add-onEPSS 14.1%CVE-2013-10037CRITICALWebTester 5.x install2.php Unauthenticated Command ExecutionEPSS 14.1%CVE-2026-2670HIGHAdvantech WISE-6610-NB Background Management openvpn_apply os command injectionEPSS 13.9%CVE-2025-52906CRITICALTOTOLINK X6000R Command Injection VulnerabilityEPSS 13.9%CVE-2026-26046HIGHMoodle: moodle: improper input sanitization in tex filter administration settingEPSS 13.8%CVE-2023-20036CRITICALCisco Industrial Network Director Command Injection VulnerabilityEPSS 13.8%CVE-2023-47415HIGHCypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.EPSS 13.8%CVE-2026-5852CRITICALTotolink A7100RU CGI cstecgi.cgi setIptvCfg os command injectionEPSS 13.7%CVE-2026-6195CRITICALTotolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injectionEPSS 13.7%