Falhas do tipo CWE-78

5.060 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2024-10919MEDIUMdidi Super-Jacoco triggerUnitCover os command injectionEPSS 5.1%CVE-2023-34356HIGHAn OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially cEPSS 5.1%CVE-2026-8271MEDIUMD-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injectionEPSS 5.1%CVE-2021-27249HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-FiEPSS 5.1%CVE-2026-4558HIGHLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injectionEPSS 5.1%CVE-2026-5351MEDIUMTrendnet TEW-657BRM setup.cgi add_wps_client os command injectionEPSS 5.1%CVE-2026-1505HIGHD-Link DIR-615 URL Filter set_temp_nodes.php os command injectionEPSS 5.1%CVE-2026-19599CRITICALRemote Code Execution vulnerabilityEPSS 5.1%CVE-2025-10359MEDIUMWavlink WL-WN578W2 wireless.cgi sub_404DBC os command injectionEPSS 5.0%CVE-2026-112195MEDIUMFusionPBX Dialplan Editor dialplan.php os command injectionEPSS 5.0%CVE-2024-4255MEDIUMRuijie RG-UAC gre_edit_commit.php os command injectionEPSS 5.0%CVE-2026-2129HIGHD-Link DIR-823X set_ac_status os command injectionEPSS 5.0%CVE-2026-2143HIGHD-Link DIR-823X DDNS Service set_ddns os command injectionEPSS 5.0%CVE-2026-8263MEDIUMTenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injectionEPSS 5.0%CVE-2020-7350MEDIUMMetasploit Framework Plugin Libnotify Command InjectionEPSS 5.0%CVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2020-10886HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1EPSS 5.0%CVE-2026-41922CRITICALWDR201A WiFi Extender OS Command Injection via wireless.cgiEPSS 5.0%CVE-2025-7788MEDIUMXuxueli xxl-job SampleXxlJob.java commandJobHandler os command injectionEPSS 4.9%CVE-2019-5141HIGHAn exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially EPSS 4.9%