Falhas do tipo CWE-78

5.060 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2026-5354MEDIUMTrendnet TEW-657BRM setup.cgi vpn_connect os command injectionEPSS 5.3%CVE-2026-5355MEDIUMTrendnet TEW-657BRM setup.cgi vpn_drop os command injectionEPSS 5.3%CVE-2026-3485CRITICALD-Link DIR-868L SSDP Service sub_1BF84 os command injectionEPSS 5.3%CVE-2026-2151HIGHD-Link DIR-615 DMZ Host Feature adv_firewall.php os command injectionEPSS 5.3%CVE-2025-22604CRITICALCacti has Authenticated RCE via multi-line SNMP responsesEPSS 5.3%CVE-2026-2063MEDIUMD-Link DIR-823X Web Management set_ac_server os command injectionEPSS 5.3%CVE-2021-21884CRITICALAn OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specEPSS 5.3%CVE-2026-25108HIGHFileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a speciallEPSS 5.2%KEVCVE-2023-33617HIGHAn OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_EPSS 5.2%CVE-2026-24763HIGHAuthenticated Command Injection in OpenClaw Docker Execution via PATH Environment VariableEPSS 5.2%CVE-2023-4411MEDIUMTOTOLINK EX1200L setTracerouteCfg os command injectionEPSS 5.2%CVE-2024-12358MEDIUMWeiYe-Jing datax-web add os command injectionEPSS 5.2%CVE-2023-35193HIGHAn OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A sEPSS 5.2%CVE-2023-35194HIGHAn OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A sEPSS 5.2%CVE-2025-10358MEDIUMWavlink WL-WN578W2 wireless.cgi sub_404850 os command injectionEPSS 5.2%CVE-2023-30854HIGHWWBN AVideo vulnerable to OS Command InjectionEPSS 5.2%CVE-2026-5844HIGHD-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injectionEPSS 5.2%CVE-2019-5138CRITICALAn exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.EPSS 5.2%CVE-2024-3191CRITICALMailCleaner Email os command injectionEPSS 5.2%CVE-2026-2061MEDIUMD-Link DIR-823X set_ipv6 sub_424D20 os command injectionEPSS 5.1%