Falhas do tipo CWE-78

4.590 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2024-28027HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 7.5%CVE-2024-28025HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 7.5%CVE-2015-10141CRITICALXdebug Remote Debugger Unauthenticated OS Command ExecutionEPSS 7.4%CVE-2016-15048CRITICALAMTT HiBOS Command Injection RCE via server_ping.phpEPSS 7.4%CVE-2025-34088HIGHPandora FMS Authenticated Remote Code Execution via Ping ModuleEPSS 7.3%CVE-2026-8188MEDIUMWavlink NU516U1 adm.cgi change_wifi_password os command injectionEPSS 7.3%CVE-2025-2701MEDIUMAMTT Hotel Broadband Operation System port_setup.php popen os command injectionEPSS 7.3%CVE-2026-8191MEDIUMWavlink NU516U1 adm.cgi wifi_region os command injectionEPSS 7.2%CVE-2026-8190MEDIUMWavlink NU516U1 adm.cgi wan os command injectionEPSS 7.2%CVE-2024-51092CRITICALLibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),EPSS 7.2%CVE-2026-19681CRITICALCommand InjectionEPSS 7.2%CVE-2020-2034HIGHPAN-OS: OS command injection vulnerability in GlobalProtect portalEPSS 7.2%CVE-2025-20029HIGHBIG-IP iControl REST and tmsh vulnerabilityEPSS 7.1%CVE-2021-42784—OS Command Injection in debug_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4EPSS 7.1%CVE-2025-10326MEDIUMMiczFlor RPi-Jukebox-RFID single.php os command injectionEPSS 7.1%CVE-2025-10680HIGHOpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variableEPSS 7.1%CVE-2026-1324HIGHSangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injectionEPSS 7.1%CVE-2022-38066HIGHAn OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafEPSS 7.1%CVE-2023-3606MEDIUMTamronOS ping os command injectionEPSS 7.1%CVE-2024-4508MEDIUMRuijie RG-UAC static_route_edit_ipv6.php os command injectionEPSS 7.1%