Falhas do tipo CWE-78
4.608 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-4497MEDIUMTotolink WA300 cstecgi.cgi recvUpgradeNewFw os command injectionEPSS 2.9%CVE-2026-86152CRITICALTenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injectionEPSS 2.9%CVE-2024-2029CRITICALCommand Injection in mudler/localaiEPSS 2.9%CVE-2025-34093HIGHPolycom HDX Series Telnet Command Injection via lan tracerouteEPSS 2.9%CVE-2021-28571HIGHAdobe After Effects improper neutralization of special elements could lead to remote code executionEPSS 2.9%CVE-2026-82703MEDIUMEdimax BR-6214K asp_setPing Endpoint ping.asp system os command injectionEPSS 2.9%CVE-2026-82702MEDIUMEdimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injectionEPSS 2.9%CVE-2026-38820HIGHopenNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on EPSS 2.9%CVE-2023-6901HIGHcodelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injectionEPSS 2.9%CVE-2026-58459HIGHgpsd gpsprof Command Injection via gnuplot plot title subtype fieldEPSS 2.9%CVE-2025-34112CRITICALRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCEEPSS 2.9%CVE-2026-19599CRITICALRemote Code Execution vulnerabilityEPSS 2.9%CVE-2024-4965MEDIUMD-Link DAR-7000-40 resmanage.php os command injectionEPSS 2.9%CVE-2022-30308CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.9%CVE-2022-30309CRITICALFESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityEPSS 2.9%CVE-2012-10041CRITICALWAN Emulator v2.3 Command ExecutionEPSS 2.8%CVE-2018-6342CRITICALreact-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoEPSS 2.8%CVE-2025-56077HIGHOS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST requEPSS 2.8%CVE-2025-56079HIGHOS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a craEPSS 2.8%CVE-2025-56089HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.8%