Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2026-83549HIGHPost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identiEPSS 9.9%KEVCVE-2023-33012HIGHA command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX EPSS 9.9%CVE-2023-7116MEDIUMWeiYe-Jing datax-web HTTP POST Request killJob os command injectionEPSS 9.8%CVE-2019-1674HIGHCisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection VulnerabilityEPSS 9.8%CVE-2018-25120CRITICALD-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_TestEPSS 9.8%CVE-2024-6184MEDIUMRuijie RG-UAC reboot_commit.php os command injectionEPSS 9.7%CVE-2023-6304HIGHTecno 4G Portable WiFi TR118 Ping Tool goform_get_cmd_process os command injectionEPSS 9.5%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.5%CVE-2022-36962HIGHSolarWinds Platform Command InjectionEPSS 9.4%CVE-2026-25620HIGHArista Edge Threat Management NGFW Captive Portal Encrypted Password Command InjectionEPSS 9.3%CVE-2026-25622HIGHArista Edge Threat Management NGFW Captive Portal Custom Handler Command InjectionEPSS 9.3%CVE-2025-6485MEDIUMTOTOLINK A3002R formWlSiteSurvey os command injectionEPSS 9.3%CVE-2023-5683MEDIUMByzoro Smart S85F Management Platform importconf.php os command injectionEPSS 9.3%CVE-2019-25441CRITICALthesystem 1.0 Command Injection via run_command endpointEPSS 9.3%CVE-2026-28287HIGHFreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsEPSS 9.3%CVE-2025-34322HIGHNagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language QueriesEPSS 9.2%CVE-2024-34921HIGHTOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.EPSS 9.2%CVE-2025-10442MEDIUMTenda AC9/AC15 exeCommand formexeCommand os command injectionEPSS 9.2%CVE-2024-6185MEDIUMRuijie RG-UAC commit.php get_ip_addr_details os command injectionEPSS 9.1%CVE-2024-5336MEDIUMRuijie RG-UAC vlan_add_commit.php addVlan os command injectionEPSS 9.0%