Falhas do tipo CWE-78
4.587 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2020-8858HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.EPSS 8.6%CVE-2024-48459HIGHA command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (Jixiang Tenda) v.DI_700EPSS 8.5%CVE-2026-83549HIGHPost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identiEPSS 8.5%KEVCVE-2019-10880CRITICALWithin multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "EPSS 8.5%CVE-2020-15612CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15429CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15422CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15435CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2020-15434CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2025-9575MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 upload.cgi cgiMain os command injectionEPSS 8.4%CVE-2024-7579MEDIUMAlien Technology ALR-F800 File Name upgrade.cgi popen os command injectionEPSS 8.4%CVE-2025-50989CRITICALOPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edEPSS 8.4%CVE-2019-25441CRITICALthesystem 1.0 Command Injection via run_command endpointEPSS 8.4%CVE-2025-10442MEDIUMTenda AC9/AC15 exeCommand formexeCommand os command injectionEPSS 8.3%CVE-2020-15611CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.3%CVE-2024-33343HIGHD-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers EPSS 8.3%CVE-2026-6992HIGHLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionEPSS 8.1%CVE-2025-9244MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaticRoute os command injectionEPSS 8.1%CVE-2020-15425CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15609CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%