Falhas do tipo CWE-78

4.563 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 96.3%CVE-2017-3506HIGHVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are EPSS 96.3%KEVCVE-2022-2068CRITICALThe c_rehash script allows command injectionEPSS 95.4%CVE-2024-1212CRITICALLoadMaster Pre-Authenticated OS Command InjectionEPSS 95.4%KEVCVE-2021-33544HIGHUDP Technology/Geutebrück camera devices: command injection leading to RCEEPSS 95.3%CVE-2018-14933CRITICALupgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeupEPSS 94.9%KEVCVE-2024-9474MEDIUMPAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceEPSS 94.7%KEVCVE-2024-51378CRITICALgetresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticatEPSS 94.7%KEVCVE-2024-8517CRITICALSPIP Bigup Multipart File Upload OS Command InjectionEPSS 94.6%CVE-2017-18368CRITICALThe ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability inEPSS 94.4%KEVCVE-2025-11953CRITICALCommand injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requestsEPSS 94.0%KEVCVE-2024-7120MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injectionEPSS 93.4%CVE-2022-33891HIGHApache Spark shell command injection vulnerability via Spark UIEPSS 93.1%KEVCVE-2024-2389CRITICALFlowmon Unauthenticated Command Injection VulnerabilityEPSS 93.0%CVE-2026-39808CRITICALA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thEPSS 92.8%KEVCVE-2018-11138CRITICALThe '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users andEPSS 92.1%KEVCVE-2022-26258CRITICALD-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.EPSS 92.0%KEVCVE-2022-31814CRITICALpfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP HEPSS 91.9%CVE-2025-34037CRITICALLinksys Routers E/WAG/WAP/WES/WET/WRT-SeriesEPSS 90.9%CVE-2021-21315HIGHCommand Injection VulnerabilityEPSS 90.7%KEV