Falhas do tipo CWE-78

4.586 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2018-25115CRITICALD-Link DIR-110/412/600/615/645/815 RCE via service.cgiEPSS 10.4%CVE-2025-25579CRITICALTOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.EPSS 10.4%CVE-2022-37056CRITICALD-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,EPSS 10.4%CVE-2026-2184MEDIUMGreat Developers Certificate Generation System csv.php os command injectionEPSS 10.3%CVE-2025-2172MEDIUMAviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line uEPSS 10.2%CVE-2025-9745MEDIUMD-Link DI-500WF jhttpd version_upgrade.asp os command injectionEPSS 10.2%CVE-2026-2846HIGHUTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injectionEPSS 10.2%CVE-2025-1608MEDIUMLB-LINK AC1900 Router set_manpwd websGetVar os command injectionEPSS 10.2%CVE-2025-1609MEDIUMLB-LINK AC1900 Router set_cmd websGetVar os command injectionEPSS 10.2%CVE-2025-10327MEDIUMMiczFlor RPi-Jukebox-RFID shuffle.php os command injectionEPSS 10.2%CVE-2024-6047CRITICALGeoVision EOL device - OS Command InjectionEPSS 10.1%KEVCVE-2024-54018MEDIUMMultiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a prEPSS 10.0%CVE-2019-6739HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. UseEPSS 9.9%CVE-2023-7116MEDIUMWeiYe-Jing datax-web HTTP POST Request killJob os command injectionEPSS 9.9%CVE-2023-33012HIGHA command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX EPSS 9.9%CVE-2026-25622HIGHArista Edge Threat Management NGFW Captive Portal Custom Handler Command InjectionEPSS 9.9%CVE-2026-25620HIGHArista Edge Threat Management NGFW Captive Portal Encrypted Password Command InjectionEPSS 9.9%CVE-2019-1674HIGHCisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection VulnerabilityEPSS 9.8%CVE-2018-25120CRITICALD-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_TestEPSS 9.8%CVE-2024-6184MEDIUMRuijie RG-UAC reboot_commit.php os command injectionEPSS 9.7%