Falhas do tipo CWE-78
4.591 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-2260HIGHD-Link DCS-931L setSysAdmin os command injectionEPSS 5.2%CVE-2023-30854HIGHWWBN AVideo vulnerable to OS Command InjectionEPSS 5.2%CVE-2025-9262MEDIUMwong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionEPSS 5.2%CVE-2019-5138CRITICALAn exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.EPSS 5.2%CVE-2024-3191CRITICALMailCleaner Email os command injectionEPSS 5.2%CVE-2024-10919MEDIUMdidi Super-Jacoco triggerUnitCover os command injectionEPSS 5.1%CVE-2026-2082MEDIUMD-Link DIR-823X set_mac_clone os command injectionEPSS 5.1%CVE-2021-27249HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-FiEPSS 5.1%CVE-2026-25108HIGHFileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a speciallEPSS 5.1%KEVCVE-2024-4255MEDIUMRuijie RG-UAC gre_edit_commit.php os command injectionEPSS 5.0%CVE-2020-7350MEDIUMMetasploit Framework Plugin Libnotify Command InjectionEPSS 5.0%CVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2025-36846CRITICALAn issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenEPSS 5.0%CVE-2026-4465MEDIUMD-Link DIR-513 formSysCmd os command injectionEPSS 5.0%CVE-2026-24763HIGHAuthenticated Command Injection in OpenClaw Docker Execution via PATH Environment VariableEPSS 5.0%CVE-2020-10886HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1EPSS 5.0%CVE-2019-5141HIGHAn exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially EPSS 4.9%CVE-2025-7788MEDIUMXuxueli xxl-job SampleXxlJob.java commandJobHandler os command injectionEPSS 4.9%CVE-2017-14429CRITICALThe DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) deviceEPSS 4.9%CVE-2022-26518CRITICALAn OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-EPSS 4.9%