Falhas do tipo CWE-78

5.061 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2025-59831HIGH`git-comiters` Command Injection vulnerabilityEPSS 4.2%CVE-2022-50795HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpEPSS 4.2%CVE-2022-40189CRITICALApache Airlfow Pig Provider RCEEPSS 4.2%CVE-2023-6309MEDIUMmoses-smt mosesdecoder trans_result.php os command injectionEPSS 4.2%CVE-2012-10046CRITICALE-Mail Security Virtual Appliance learn-msg.cgi Command InjectionEPSS 4.1%CVE-2025-7097CRITICALComodo Internet Security Premium Manifest File cis_update_x64.xml os command injectionEPSS 4.1%CVE-2021-27476CRITICALRockwell Automation FactoryTalk AssetCentre OS Command InjectionEPSS 4.1%CVE-2026-8632HIGHHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code ExecutionEPSS 4.1%CVE-2026-119742HIGHNagios XI < 2026R2 OS Command Injection via mibs.phpEPSS 4.1%CVE-2022-32586HIGHAn OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-OEPSS 4.1%CVE-2019-14894HIGHA flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code executEPSS 4.1%CVE-2026-7096HIGHTenda HG3 formgponConf os command injectionEPSS 4.1%CVE-2026-108576CRITICALTOZED X300 IPPingDiagnostics process_ping os command injectionEPSS 4.1%CVE-2025-67840HIGHMultiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_EPSS 4.1%CVE-2024-2812MEDIUMTenda AC15 WriteFacMac formWriteFacMac os command injectionEPSS 4.0%CVE-2011-10026CRITICALSpreecommerce < 0.50.x API RCEEPSS 4.0%CVE-2021-3584—A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration opEPSS 4.0%CVE-2025-11407MEDIUMD-Link DI-7001 MINI upgrade_filter.asp os command injectionEPSS 4.0%CVE-2024-14005CRITICALNagios XI < 2024R1.2 Command Injection via Docker WizardEPSS 4.0%CVE-2025-34284CRITICALNagios XI < 2024R2 Authenticated Command Injection via WinRM PluginEPSS 4.0%