Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-27549HIGHCommand Injection in /index.php/attached_devices_tab/do_uploadEPSS 2.9%CVE-2026-27547HIGHCommand Injection in /index.php/ajax/get_iodd_menu_infoEPSS 2.9%CVE-2026-27554HIGHCommand Injection in /index.php/ajax/save_iodd_parametersEPSS 2.9%CVE-2014-0156—Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argumentEPSS 2.9%CVE-2025-59360CRITICALOS command injection in Chaos Mesh via the killProcesses mutationEPSS 2.9%CVE-2025-56091HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crEPSS 2.9%CVE-2025-56086HIGHOS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitraEPSS 2.9%CVE-2025-56090HIGHOS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary cEPSS 2.9%CVE-2020-5352HIGHDell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may EPSS 2.9%CVE-2022-27003HIGHTotolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabilEPSS 2.9%CVE-2022-27004HIGHTotolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabilEPSS 2.9%CVE-2024-3739MEDIUMcym1102 nginxWebUI upload os command injectionEPSS 2.9%CVE-2026-58146CRITICALUnauthorized remote code execution in T-Mobile 5G Box IDU routersEPSS 2.9%CVE-2021-21819CRITICALA code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network rEPSS 2.9%CVE-2026-86152CRITICALTenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injectionEPSS 2.9%CVE-2024-2029CRITICALCommand Injection in mudler/localaiEPSS 2.9%CVE-2025-71429CRITICALGPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.pyEPSS 2.9%CVE-2026-82702MEDIUMEdimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injectionEPSS 2.9%CVE-2026-82703MEDIUMEdimax BR-6214K asp_setPing Endpoint ping.asp system os command injectionEPSS 2.9%CVE-2026-38820HIGHopenNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on EPSS 2.9%