Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-6901HIGHcodelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injectionEPSS 2.9%CVE-2026-58459HIGHgpsd gpsprof Command Injection via gnuplot plot title subtype fieldEPSS 2.9%CVE-2025-66211CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script FilenameEPSS 2.9%CVE-2022-21129HIGHVersions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exporEPSS 2.9%CVE-2025-66210CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database ImportEPSS 2.9%CVE-2024-4965MEDIUMD-Link DAR-7000-40 resmanage.php os command injectionEPSS 2.9%CVE-2026-8153CRITICALCommand injection in Dashboard Server interfaceEPSS 2.9%CVE-2018-6342CRITICALreact-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoEPSS 2.8%CVE-2025-56077HIGHOS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST requEPSS 2.8%CVE-2025-56079HIGHOS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a craEPSS 2.8%CVE-2025-56089HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.8%CVE-2025-34093HIGHPolycom HDX Series Telnet Command Injection via lan tracerouteEPSS 2.8%CVE-2026-101214HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.8%CVE-2026-86379HIGHDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1EPSS 2.8%CVE-2026-101210HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.8%CVE-2022-41942HIGHSourcegraph vulnerable to Comand Injection via gitserverEPSS 2.8%CVE-2021-37912CRITICALHGiga OAKlouds - Command Injection-1EPSS 2.8%CVE-2021-37913CRITICALHGiga OAKlouds - Command Injection-2EPSS 2.8%CVE-2022-38547HIGHA post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPNEPSS 2.8%CVE-2022-37337CRITICALA command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTPEPSS 2.8%