Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-5336MEDIUMRuijie RG-UAC vlan_add_commit.php addVlan os command injectionEPSS 9.0%CVE-2024-10224MEDIUMQualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possiblyEPSS 9.0%CVE-2026-29058CRITICALAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpEPSS 8.9%CVE-2024-7580MEDIUMAlien Technology ALR-F800 system.html os command injectionEPSS 8.9%CVE-2026-8188MEDIUMWavlink NU516U1 adm.cgi change_wifi_password os command injectionEPSS 8.9%CVE-2026-45087CRITICALDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeEPSS 8.7%CVE-2024-6186MEDIUMRuijie RG-UAC commit.php os command injectionEPSS 8.7%CVE-2026-8190MEDIUMWavlink NU516U1 adm.cgi wan os command injectionEPSS 8.7%CVE-2026-8191MEDIUMWavlink NU516U1 adm.cgi wifi_region os command injectionEPSS 8.7%CVE-2023-34105HIGHSRS has command injection vulnerability in demonstration api-server for HTTP callback.EPSS 8.7%CVE-2026-111218HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper LimitersEPSS 8.6%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2020-8858HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.EPSS 8.6%CVE-2024-48459HIGHA command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (Jixiang Tenda) v.DI_700EPSS 8.5%CVE-2018-14558CRITICALAn issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318EPSS 8.5%KEVCVE-2019-10880CRITICALWithin multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "EPSS 8.5%CVE-2020-15612CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15434CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15422CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15429CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%