Falhas do tipo CWE-78

4.585 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2025-6299MEDIUMTOTOLINK N150RT formWSC os command injectionEPSS 11.6%CVE-2024-11003HIGHQualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. TEPSS 11.5%CVE-2024-7261CRITICALThe improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4EPSS 11.4%CVE-2022-36510HIGHH3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.EPSS 11.2%CVE-2022-36509HIGHH3C GR3200 MiniGR1B0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.EPSS 11.2%CVE-2024-53376HIGHCyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field tEPSS 10.9%CVE-2026-9532MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injectionEPSS 10.8%CVE-2026-9531MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injectionEPSS 10.8%CVE-2026-9534MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injectionEPSS 10.8%CVE-2026-9515MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionEPSS 10.8%CVE-2026-9514MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injectionEPSS 10.8%CVE-2026-9533MEDIUMTotolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injectionEPSS 10.8%CVE-2026-35216CRITICALBudibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation StepEPSS 10.7%CVE-2025-45858CRITICALTOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.EPSS 10.7%CVE-2022-38841HIGHLinksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute paEPSS 10.7%CVE-2025-7407MEDIUMNetgear D6400 diag.cgi os command injectionEPSS 10.6%CVE-2025-54123CRITICALHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationEPSS 10.5%CVE-2022-46552HIGHD-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlistEPSS 10.5%CVE-2026-4840HIGHNetcore Power 15AX Diagnostic Tool netis.cgi setTools os command injectionEPSS 10.5%CVE-2024-21786HIGHAn OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5.EPSS 10.4%