Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2024-5338MEDIUMRuijie RG-UAC online.php os command injectionEPSS 7.9%CVE-2024-4507MEDIUMRuijie RG-UAC static_route_add_ipv6.php os command injectionEPSS 7.9%CVE-2025-11285MEDIUMsamanhappy MCPHub serverController.ts os command injectionEPSS 7.9%CVE-2026-8228MEDIUMWavlink NU516U1 wireless.cgi advance os command injectionEPSS 7.8%CVE-2026-8189MEDIUMWavlink NU516U1 adm.cgi wzdrepeater os command injectionEPSS 7.8%CVE-2024-2897MEDIUMTenda AC7 WriteFacMac formWriteFacMac os command injectionEPSS 7.8%CVE-2025-10328MEDIUMMiczFlor RPi-Jukebox-RFID playsinglefile.php os command injectionEPSS 7.8%CVE-2023-5494MEDIUMByzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform download.php os command injectionEPSS 7.7%CVE-2025-1616MEDIUMFiberHome AN5506-01A ONU GPON Diagnosis os command injectionEPSS 7.7%CVE-2025-43989MEDIUMThe /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesettiEPSS 7.7%CVE-2025-9387MEDIUMDCN DCME-720 Web Management Backend ip_block.php os command injectionEPSS 7.7%CVE-2026-6204HIGHLibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config EPSS 7.7%CVE-2025-10680HIGHOpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variableEPSS 7.7%CVE-2021-32849HIGHArbitrary command execution in GerapyEPSS 7.6%CVE-2024-6187MEDIUMRuijie RG-UAC sub_commit.php os command injectionEPSS 7.6%CVE-2025-50475CRITICALAn OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute EPSS 7.6%CVE-2025-34513CRITICALIlevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command InjectionEPSS 7.6%CVE-2024-4506MEDIUMRuijie RG-UAC ip_addr_edit_commit.php os command injectionEPSS 7.6%CVE-2026-48030CRITICALPheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)EPSS 7.5%CVE-2026-79756HIGHNuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platformEPSS 7.5%