Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-24663CRITICALCopeland XWEB and XWEB Pro OS Command InjectionEPSS 3.7%CVE-2022-1440CRITICALCommand Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interfaceEPSS 3.7%CVE-2024-20720CRITICALCommand injection in data collector backup due to insufficient patching of CVE-2023-38208EPSS 3.7%CVE-2018-4859—A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/EPSS 3.7%CVE-2018-4860—A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/EPSS 3.7%CVE-2024-8926HIGHPHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)EPSS 3.7%CVE-2022-50794CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via UsernameEPSS 3.7%CVE-2021-40409CRITICALAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] orEPSS 3.7%CVE-2021-40408CRITICALAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] orEPSS 3.7%CVE-2022-34850CRITICALAn OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.EPSS 3.6%CVE-2023-26134CRITICALVersions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfoEPSS 3.6%CVE-2023-22299HIGHAn OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesight UR32L v32.3.0.5. A specially crafted EPSS 3.6%CVE-2020-8178—Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.EPSS 3.6%CVE-2026-28409CRITICALWeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionEPSS 3.6%CVE-2026-4465MEDIUMD-Link DIR-513 formSysCmd os command injectionEPSS 3.6%CVE-2019-1971HIGHCisco Enterprise NFV Infrastructure Software Command Injection VulnerabilityEPSS 3.6%CVE-2026-85222CRITICALD-Link DNS-340L Add-On Center addon_center.cgi os command injectionEPSS 3.6%CVE-2026-82691CRITICALD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injectionEPSS 3.6%CVE-2026-85224CRITICALD-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injectionEPSS 3.6%CVE-2026-82690CRITICALD-Link DNS-327L/DNS-340L ve_mgr.cgi os command injectionEPSS 3.6%