Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2026-2184MEDIUMGreat Developers Certificate Generation System csv.php os command injectionEPSS 10.5%CVE-2022-46552HIGHD-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlistEPSS 10.5%CVE-2026-2847HIGHUTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injectionEPSS 10.5%CVE-2024-21786HIGHAn OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5.EPSS 10.4%CVE-2025-25579CRITICALTOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.EPSS 10.4%CVE-2018-25115CRITICALD-Link DIR-110/412/600/615/645/815 RCE via service.cgiEPSS 10.4%CVE-2026-9534MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injectionEPSS 10.4%CVE-2026-9533MEDIUMTotolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injectionEPSS 10.4%CVE-2026-9514MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injectionEPSS 10.4%CVE-2026-9531MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injectionEPSS 10.4%CVE-2026-9515MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionEPSS 10.4%CVE-2026-9532MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injectionEPSS 10.4%CVE-2025-1609MEDIUMLB-LINK AC1900 Router set_cmd websGetVar os command injectionEPSS 10.2%CVE-2025-1608MEDIUMLB-LINK AC1900 Router set_manpwd websGetVar os command injectionEPSS 10.2%CVE-2025-10327MEDIUMMiczFlor RPi-Jukebox-RFID shuffle.php os command injectionEPSS 10.2%CVE-2026-3040MEDIUMDrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injectionEPSS 10.1%CVE-2024-6047CRITICALGeoVision EOL device - OS Command InjectionEPSS 10.1%KEVCVE-2024-54018MEDIUMMultiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a prEPSS 10.0%CVE-2026-15733CRITICALWGDashboard Remote Code Execution vulnerabilityEPSS 10.0%CVE-2019-6739HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. UseEPSS 9.9%