Falhas do tipo CWE-78
5.060 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2021-20991CRITICALFibaro Home Center Authenticated remote command executionEPSS 5.6%CVE-2025-25038CRITICALMiniDVBLinux Root Command InjectionEPSS 5.5%CVE-2025-9580MEDIUMLB-LINK BL-X26 HTTP set_blacklist os command injectionEPSS 5.5%CVE-2026-13545HIGHD-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injectionEPSS 5.5%CVE-2025-5620MEDIUMD-Link DIR-816 setipsec_config os command injectionEPSS 5.5%CVE-2017-15103—A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially EPSS 5.5%CVE-2026-9787HIGHQuest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution VulnerabilityEPSS 5.5%CVE-2025-35028CRITICALHexStrike AI MCP Server Command InjectionEPSS 5.5%CVE-2024-57357HIGHAn issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_42EPSS 5.5%CVE-2025-34073CRITICALstamparm/maltrail <=0.54 Remote Command ExecutionEPSS 5.5%CVE-2020-5760—Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote EPSS 5.5%CVE-2022-27005HIGHTotolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabilEPSS 5.5%CVE-2025-8818MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setLan setDFSSetting os command injectionEPSS 5.5%CVE-2026-2152HIGHD-Link DIR-615 Web Configuration adv_routing.php os command injectionEPSS 5.4%CVE-2022-45005CRITICALIP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function.EPSS 5.4%CVE-2025-5621MEDIUMD-Link DIR-816 qosClassifier os command injectionEPSS 5.4%CVE-2026-111224HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.shEPSS 5.4%CVE-2020-17406HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112EPSS 5.3%CVE-2025-30289HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 5.3%CVE-2026-5354MEDIUMTrendnet TEW-657BRM setup.cgi vpn_connect os command injectionEPSS 5.3%