Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2021-3198MEDIUMIvanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionEPSS 3.3%CVE-2020-13378HIGHLoadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to exEPSS 3.3%CVE-2026-25070CRITICALXikeStor SKS8310-8X PingTestSet Command InjectionEPSS 3.3%CVE-2019-15979HIGHCisco Data Center Network Manager Command Injection VulnerabilitiesEPSS 3.3%CVE-2026-60121CRITICALVitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.phpEPSS 3.3%CVE-2024-23109CRITICALAn improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to EPSS 3.3%CVE-2021-24033—react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be EPSS 3.3%CVE-2026-8986CRITICALCommand Injection via Malicious OCPP ServerEPSS 3.3%CVE-2025-66213CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount PathEPSS 3.3%CVE-2022-31138HIGHOS Command Injection in mailcowEPSS 3.3%CVE-2025-10774MEDIUMRuijie 6000-E10 sub_commit.php os command injectionEPSS 3.3%CVE-2026-82692CRITICALD-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injectionEPSS 3.3%CVE-2026-82689CRITICALD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injectionEPSS 3.3%CVE-2026-90699CRITICALD-Link DWR-M920 formPinManageSetup sub_41E60C os command injectionEPSS 3.3%CVE-2026-85223CRITICALD-Link DNS-340L CGI dropbox.cgi os command injectionEPSS 3.3%CVE-2026-71966HIGHCyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransferEPSS 3.3%CVE-2022-37899HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 3.3%CVE-2022-37901HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 3.3%CVE-2025-56094HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 3.3%CVE-2022-37900HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 3.3%