Falhas do tipo CWE-78
5.060 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-2042HIGHNagios Host monitoringwizard Command Injection Remote Code Execution VulnerabilityEPSS 6.1%CVE-2023-28381HIGHAn OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A speEPSS 6.1%CVE-2025-15500CRITICALSangfor Operation and Maintenance Management System HTTP POST Request getHis os command injectionEPSS 6.1%CVE-2021-21882CRITICALAn OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A speciallyEPSS 6.1%CVE-2021-21883CRITICALAn OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A sEPSS 6.1%CVE-2021-21872CRITICALAn OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0REPSS 6.1%CVE-2025-15502MEDIUMSangfor Operation and Maintenance Management System session SessionController os command injectionEPSS 6.1%CVE-2024-28026HIGHThree OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5EPSS 6.0%CVE-2022-40969HIGHAn os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specialEPSS 6.0%CVE-2022-26420CRITICALAn OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A speciallyEPSS 5.9%CVE-2022-26075CRITICALAn OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A speciallyEPSS 5.9%CVE-2023-27380HIGHAn OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A speciallyEPSS 5.9%CVE-2019-5477—A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` meEPSS 5.9%CVE-2020-1946—Apache SpamAssassin has an OS Command Injection vulnerabilityEPSS 5.9%CVE-2026-2082MEDIUMD-Link DIR-823X set_mac_clone os command injectionEPSS 5.9%CVE-2025-34103CRITICALWePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgiEPSS 5.9%CVE-2025-10326MEDIUMMiczFlor RPi-Jukebox-RFID single.php os command injectionEPSS 5.9%CVE-2023-37477HIGHCommand injection in firewall ip functionality in 1PanelEPSS 5.8%CVE-2026-2260HIGHD-Link DCS-931L setSysAdmin os command injectionEPSS 5.8%CVE-2025-8830MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setWan sub_3517C os command injectionEPSS 5.8%