Falhas do tipo CWE-78

4.582 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2026-36356CRITICALThe GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injecEPSS 13.5%CVE-2026-15733CRITICALWGDashboard Remote Code Execution vulnerabilityEPSS 13.5%CVE-2023-50094HIGHreNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/toEPSS 13.5%CVE-2023-50358MEDIUMQTS, QuTS hero, QuTScloudEPSS 13.5%CVE-2026-6195CRITICALTotolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injectionEPSS 13.5%CVE-2026-5853CRITICALTotolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injectionEPSS 13.5%CVE-2025-5946HIGHRCE via the poller reload feature available only to user with high privilegeEPSS 13.5%CVE-2026-5852CRITICALTotolink A7100RU CGI cstecgi.cgi setIptvCfg os command injectionEPSS 13.5%CVE-2025-52379MEDIUMNexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware uEPSS 13.5%CVE-2025-6978HIGHDiagnostics command injection vulnerabilityEPSS 13.4%CVE-2026-6483HIGHWavlink WL-WN530H4 internet.cgi snprintf os command injectionEPSS 13.4%CVE-2026-5851CRITICALTotolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injectionEPSS 13.4%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2025-1610MEDIUMLB-LINK AC1900 Router set_blacklist websGetVar os command injectionEPSS 13.2%CVE-2023-20036CRITICALCisco Industrial Network Director Command Injection VulnerabilityEPSS 13.1%CVE-2020-15778HIGHscp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destinatEPSS 13.0%CVE-2025-68154HIGHCommand Injection in fsSize() on WindowsEPSS 13.0%CVE-2026-45087CRITICALDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeEPSS 13.0%CVE-2025-2094MEDIUMTOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig os command injectionEPSS 13.0%CVE-2025-52906CRITICALTOTOLINK X6000R Command Injection VulnerabilityEPSS 12.8%