Falhas do tipo CWE-78
4.591 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-2909HIGHRuijie RG-EG350 HTTP POST Request setAction os command injectionEPSS 4.0%CVE-2025-10774MEDIUMRuijie 6000-E10 sub_commit.php os command injectionEPSS 4.0%CVE-2024-51503HIGHA security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate pEPSS 4.0%CVE-2026-2210HIGHD-Link DIR-823X set_filtering sub_4211C8 os command injectionEPSS 4.0%CVE-2017-10951—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interactiEPSS 4.0%CVE-2026-2155HIGHD-Link DIR-823X Configuration set_dmz sub_4208A0 os command injectionEPSS 4.0%CVE-2024-2353HIGHTotolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injectionEPSS 4.0%CVE-2018-10900HIGHNetwork Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line characEPSS 3.9%CVE-2023-6320CRITICALCommand injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpointEPSS 3.9%CVE-2025-9026MEDIUMD-Link DIR-860L Simple Service Discovery Protocol cgibin ssdpcgi_main os command injectionEPSS 3.9%CVE-2026-2175HIGHD-Link DIR-823X set_upnp sub_420618 os command injectionEPSS 3.9%CVE-2026-16492MEDIUMumijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injectionEPSS 3.9%CVE-2026-95675CRITICALD-Link DAP-1360 6.14 Unauthenticated RCE via Web Management InterfaceEPSS 3.9%CVE-2019-3920—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTPEPSS 3.9%CVE-2019-3919—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent EPSS 3.9%CVE-2020-3430HIGHCisco Jabber for Windows Protocol Handler Command Injection VulnerabilityEPSS 3.9%CVE-2024-51228MEDIUMAn issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1EPSS 3.9%CVE-2022-21668HIGHPipenv's requirements.txt parsing allows malicious index url in commentsEPSS 3.9%CVE-2024-2854MEDIUMTenda AC18 setsambacfg formSetSambaConf os command injectionEPSS 3.9%CVE-2022-32586HIGHAn OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-OEPSS 3.9%