Falhas do tipo CWE-78

4.591 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2023-5301MEDIUMDedeCMS album_add.php AddMyAddon os command injectionEPSS 6.2%CVE-2024-24329CRITICALTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortFEPSS 6.2%CVE-2024-24328HIGHTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFiEPSS 6.2%CVE-2021-4473CRITICALTianxin Internet Behavior Management System Command Injection via toQuery.phpEPSS 6.2%CVE-2025-15500CRITICALSangfor Operation and Maintenance Management System HTTP POST Request getHis os command injectionEPSS 6.2%CVE-2025-3816MEDIUMwestboy CicadasCMS Scheduled Task save os command injectionEPSS 6.2%CVE-2025-15502MEDIUMSangfor Operation and Maintenance Management System session SessionController os command injectionEPSS 6.1%CVE-2020-1946—Apache SpamAssassin has an OS Command Injection vulnerabilityEPSS 6.1%CVE-2025-10359MEDIUMWavlink WL-WN578W2 wireless.cgi sub_404DBC os command injectionEPSS 6.1%CVE-2025-10358MEDIUMWavlink WL-WN578W2 wireless.cgi sub_404850 os command injectionEPSS 6.1%CVE-2021-21872CRITICALAn OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0REPSS 6.1%CVE-2021-21882CRITICALAn OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A speciallyEPSS 6.1%CVE-2021-21883CRITICALAn OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A sEPSS 6.1%CVE-2025-34103CRITICALWePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgiEPSS 6.0%CVE-2022-42484CRITICALAn OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP requesEPSS 6.0%CVE-2024-28026HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 6.0%CVE-2022-26420CRITICALAn OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A speciallyEPSS 6.0%CVE-2022-26075CRITICALAn OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A speciallyEPSS 6.0%CVE-2026-25623HIGHArista Edge Threat Management NGFW UI Arbitrary Command ExecutionEPSS 6.0%CVE-2026-3101MEDIUMIntelbras TIP 635G Ping os command injectionEPSS 5.9%