Falhas do tipo CWE-78
4.604 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-19036HIGHShibby Tomato wanoptions sub_40F88C os command injectionEPSS 3.2%CVE-2026-92397CRITICALRuijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injectionEPSS 3.2%CVE-2026-19034HIGHShibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injectionEPSS 3.2%CVE-2026-75094CRITICALCOMFAST CF-N1-S CGI mbox-config sub_44B438 os command injectionEPSS 3.2%CVE-2026-19035HIGHShibby Tomato qoslimit new_qoslimit_start os command injectionEPSS 3.2%CVE-2019-14889HIGHA flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects tEPSS 3.2%CVE-2026-27190HIGHDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processEPSS 3.2%CVE-2026-71952CRITICALD-Link DWR-M961 Command Injection via /boafrm/formPinManageSetupEPSS 3.2%CVE-2026-71951CRITICALD-Link DWR-M961 Command Injection via /boafrm/formIMEISetupEPSS 3.2%CVE-2026-71953CRITICALD-Link DWR-M961 Command Injection via /boafrm/formNtpEPSS 3.2%CVE-2026-71949CRITICALD-Link DWR-M961 Command Injection via /boafrm/formUSSDSetupEPSS 3.2%CVE-2026-71955CRITICALD-Link DWR-M961 Command Injection via /boafrm/formWscEPSS 3.2%CVE-2026-71954CRITICALD-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetupEPSS 3.2%CVE-2026-71950CRITICALD-Link DWR-M961 Command Injection via /boafrm/formSmsManageEPSS 3.2%CVE-2026-71948CRITICALD-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRunEPSS 3.2%CVE-2026-71947CRITICALD-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRunEPSS 3.2%CVE-2026-89010CRITICALWAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_serverEPSS 3.2%CVE-2026-71956CRITICALD-Link DWR-M961 Command Injection via app.cgiEPSS 3.2%CVE-2026-71946CRITICALD-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRunEPSS 3.2%CVE-2026-71944CRITICALD-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectelEPSS 3.2%