Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2026-56274HIGHFlowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessEPSS 7.5%CVE-2025-34043CRITICALVacron NVR Remote Command ExecutionEPSS 7.5%CVE-2025-34041CRITICALSangfor Endpoint Detection and Response OS Command InjectionEPSS 7.5%CVE-2023-5301MEDIUMDedeCMS album_add.php AddMyAddon os command injectionEPSS 7.5%CVE-2024-28025HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 7.5%CVE-2024-28027HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 7.5%CVE-2025-2701MEDIUMAMTT Hotel Broadband Operation System port_setup.php popen os command injectionEPSS 7.4%CVE-2026-8273MEDIUMD-Link DNS-320 system_mgr.cgi cgi_merge_user os command injectionEPSS 7.4%CVE-2025-34088HIGHPandora FMS Authenticated Remote Code Execution via Ping ModuleEPSS 7.4%CVE-2016-15048CRITICALAMTT HiBOS Command Injection RCE via server_ping.phpEPSS 7.4%CVE-2022-38066HIGHAn OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafEPSS 7.3%CVE-2025-13087HIGHCommand Injection in Opto22 Groov REST APIEPSS 7.3%CVE-2025-0798CRITICALMicroWorld eScan Antivirus Quarantine rtscanner os command injectionEPSS 7.3%CVE-2024-51092CRITICALLibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),EPSS 7.2%CVE-2020-2034HIGHPAN-OS: OS command injection vulnerability in GlobalProtect portalEPSS 7.2%CVE-2025-20029HIGHBIG-IP iControl REST and tmsh vulnerabilityEPSS 7.1%CVE-2015-10141CRITICALXdebug Remote Debugger Unauthenticated OS Command ExecutionEPSS 7.1%CVE-2021-42784—OS Command Injection in debug_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4EPSS 7.1%CVE-2026-2188HIGHUTT 进取 521G formPdbUpConfig sub_446B18 os command injectionEPSS 7.1%CVE-2026-8985CRITICALUnauthenticated Command InjectionEPSS 7.1%