Falhas do tipo CWE-78

5.059 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2018-6530CRITICALOS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previousEPSS 96.7%KEVCVE-2022-2068CRITICALThe c_rehash script allows command injectionEPSS 96.4%CVE-2025-34037CRITICALLinksys Routers E/WAG/WAP/WES/WET/WRT-SeriesEPSS 96.2%CVE-2017-3506HIGHVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are EPSS 96.0%KEVCVE-2021-33544HIGHUDP Technology/Geutebrück camera devices: command injection leading to RCEEPSS 95.8%CVE-2024-1212CRITICALLoadMaster Pre-Authenticated OS Command InjectionEPSS 95.4%KEVCVE-2018-14933CRITICALupgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeupEPSS 94.8%KEVCVE-2024-51378CRITICALgetresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticatEPSS 94.7%KEVCVE-2024-8517CRITICALSPIP Bigup Multipart File Upload OS Command InjectionEPSS 94.5%CVE-2017-18368CRITICALThe ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability inEPSS 94.5%KEVCVE-2025-11953CRITICALCommand injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requestsEPSS 94.0%KEVCVE-2026-1731CRITICALRemote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)EPSS 93.9%KEVCVE-2024-9474MEDIUMPAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceEPSS 93.8%KEVCVE-2024-7120MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injectionEPSS 93.5%CVE-2022-33891HIGHApache Spark shell command injection vulnerability via Spark UIEPSS 93.2%KEVCVE-2026-39808CRITICALA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thEPSS 93.2%KEVCVE-2024-2389CRITICALFlowmon Unauthenticated Command Injection VulnerabilityEPSS 93.0%CVE-2023-20273HIGHA vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the priEPSS 92.9%KEVCVE-2022-31814CRITICALpfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP HEPSS 91.9%CVE-2018-11138CRITICALThe '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users andEPSS 91.6%KEV