Falhas do tipo CWE-78
5.060 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2017-14429CRITICALThe DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) deviceEPSS 4.9%CVE-2022-4221CRITICALOS command injection in ASUS M25 NASEPSS 4.9%CVE-2024-0292MEDIUMTotolink LR1200GB cstecgi.cgi setOpModeCfg os command injectionEPSS 4.9%CVE-2026-8259MEDIUMTenda AC6 httpd telnet os command injectionEPSS 4.9%CVE-2025-7382HIGHA command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achievEPSS 4.9%CVE-2025-36846CRITICALAn issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenEPSS 4.9%CVE-2022-26518CRITICALAn OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-EPSS 4.9%CVE-2026-8265MEDIUMTenda AC6 httpd getLogFile get_log_file os command injectionEPSS 4.8%CVE-2024-0293MEDIUMTotolink LR1200GB cstecgi.cgi setUploadSetting os command injectionEPSS 4.8%CVE-2018-11616—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interactEPSS 4.8%CVE-2026-78488MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 4.8%CVE-2014-125118CRITICALeScan 5.5-2 Web Management Console Command InjectionEPSS 4.8%CVE-2025-5440MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 NTP os command injectionEPSS 4.8%CVE-2025-5439MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 verifyFacebookLike os command injectionEPSS 4.8%CVE-2022-29472CRITICALAn OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One SEPSS 4.8%CVE-2023-0935MEDIUMDolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injectionEPSS 4.8%CVE-2021-21016CRITICALMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 4.8%CVE-2025-6899MEDIUMD-Link DI-7300G+/DI-8200G msp_info.htm os command injectionEPSS 4.8%CVE-2022-45915HIGHILIAS before 7.16 allows OS Command Injection.EPSS 4.8%CVE-2023-2573HIGHAuthenticated Command InjectionEPSS 4.8%