Falhas do tipo CWE-78

5.061 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2025-66209CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database BackupEPSS 3.9%CVE-2022-33150CRITICALAn OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network rEPSS 3.9%CVE-2022-44808CRITICALA command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to executeEPSS 3.9%CVE-2017-17407—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.EPSS 3.9%CVE-2025-7553MEDIUMD-Link DIR-818LW System Time Page os command injectionEPSS 3.9%CVE-2023-26153HIGHVersions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_EPSS 3.8%CVE-2016-15047HIGHAVTECH CloudSetup.cgi Authenticated Command InjectionEPSS 3.8%CVE-2021-31891—A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on DebEPSS 3.8%CVE-2024-0298HIGHTotolink N200RE cstecgi.cgi setDiagnosisCfg os command injectionEPSS 3.8%CVE-2024-0296HIGHTotolink N200RE cstecgi.cgi NTPSyncWithHost os command injectionEPSS 3.8%CVE-2024-0294HIGHTotolink LR1200GB cstecgi.cgi setUssd os command injectionEPSS 3.8%CVE-2024-0299HIGHTotolink N200RE cstecgi.cgi setTracerouteCfg os command injectionEPSS 3.8%CVE-2024-0297HIGHTotolink N200RE cstecgi.cgi UploadFirmwareFile os command injectionEPSS 3.8%CVE-2024-0295HIGHTotolink LR1200GB cstecgi.cgi setWanCfg os command injectionEPSS 3.8%CVE-2020-26301HIGHCommand injection in mscdex/ssh2EPSS 3.8%CVE-2025-11138MEDIUMmirweiye wenkucms common.php createPathOne os command injectionEPSS 3.8%CVE-2026-18900HIGHH3C NX15 Backend RPC esps file.exec os command injectionEPSS 3.8%CVE-2026-1544MEDIUMD-Link DIR-823X set_mode sub_41E2A0 os command injectionEPSS 3.8%CVE-2020-15123CRITICALCommand injection in codecov (npm package)EPSS 3.8%CVE-2022-21178CRITICALAn os command injection vulnerability exists in the confsrv ucloud_add_new_node functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A sEPSS 3.8%