Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-4221HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%CVE-2022-42490CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.5%CVE-2022-33140—Improper Neutralization of Command Elements in Shell User Group ProviderEPSS 3.5%CVE-2019-1850HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.5%CVE-2025-34029CRITICALEdimax EW-7438RPn Mini OS Command Injection via syscmd.aspEPSS 3.5%CVE-2019-12690HIGHCisco Firepower Management Center Command Injection VulnerabilityEPSS 3.5%CVE-2026-76197CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2026-76195CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2026-48362CRITICALColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2022-33192CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.5%CVE-2022-33195CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.5%CVE-2022-32773CRITICALAn OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and EPSS 3.5%CVE-2020-8270—An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 EPSS 3.5%CVE-2025-34115HIGHOP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.phpEPSS 3.5%CVE-2026-113802CRITICALWavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file HandlerEPSS 3.5%CVE-2025-56088HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request toEPSS 3.5%CVE-2020-37282CRITICALoffice-converter through 1.0.2 OS Command Injection via fileName in generatePdfEPSS 3.4%CVE-2023-46683HIGHA post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada GigabEPSS 3.4%CVE-2023-47209HIGHA post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.EPSS 3.4%CVE-2023-42664HIGHA post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VEPSS 3.4%