Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-38692CRITICALCommand injection vulnerability in module management function in CloudExplorer LiteEPSS 3.4%CVE-2012-10040CRITICALOpenfiler v2.x NetworkCard Command ExecutionEPSS 3.4%CVE-2025-59361CRITICALOS command injection in Chaos Mesh via the cleanIptables mutationEPSS 3.4%CVE-2013-10073HIGHNagios XI < 2012R1.6 Auto-Discovery Shell Command InjectionEPSS 3.4%CVE-2026-74233CRITICALZbtlink MQWrt infosrvd Command InjectionEPSS 3.4%CVE-2024-7066MEDIUMF-logic DataCube3 HTTP POST Request config_time_sync.php os command injectionEPSS 3.4%CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2022-42491CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.4%CVE-2022-42492CRITICALSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netwEPSS 3.4%CVE-2020-37123CRITICALPinger 1.0 - Remote Code ExecutionEPSS 3.3%CVE-2023-31128HIGHNextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command InjectionEPSS 3.3%CVE-2025-34151CRITICALShenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command InjectionEPSS 3.3%CVE-2026-102096HIGHKiteworks Core OS command injectionEPSS 3.3%CVE-2025-66644HIGHArray Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.EPSS 3.3%KEVCVE-2025-3729MEDIUMSourceCodester Web-based Pharmacy Product Management System Database Backup backup.php os command injectionEPSS 3.3%CVE-2024-9001MEDIUMTOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injectionEPSS 3.3%CVE-2023-4464HIGHPoly VVX 601 Diagnostic Telnet Mode os command injectionEPSS 3.3%CVE-2025-4032LOWinclusionAI AWorld shell_tool.py subprocess.Popen os command injectionEPSS 3.3%CVE-2025-7850CRITICALAuthenticated OS command executionEPSS 3.3%CVE-2026-25244CRITICALWebdriverIO has Command Injection in the BrowserStack ServiceEPSS 3.3%