Falhas do tipo CWE-78
4.610 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-10873HIGHShibby Tomato Web UI rstats rstats_path os command injectionEPSS 2.7%CVE-2021-21876CRITICALSpecially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests toEPSS 2.7%CVE-2021-21877CRITICALSpecially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests EPSS 2.7%CVE-2018-25083CRITICALThe pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.EPSS 2.7%CVE-2023-26921CRITICALOS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.EPSS 2.7%CVE-2022-42999HIGHD-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /gEPSS 2.7%CVE-2024-5181CRITICALCommand Injection in mudler/localaiEPSS 2.7%CVE-2025-35027HIGHUnitree Multiple Robotic Products Command InjectionEPSS 2.7%CVE-2026-7256HIGH** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 coEPSS 2.7%CVE-2024-4343CRITICALPython Command Injection in imartinez/privategptEPSS 2.7%CVE-2025-1546MEDIUMBDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injectionEPSS 2.7%CVE-2026-15495MEDIUMSonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injectionEPSS 2.7%CVE-2021-33721—A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elementEPSS 2.7%CVE-2025-55037CRITICALImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.EPSS 2.7%CVE-2026-22225HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0EPSS 2.7%CVE-2026-58452HIGHJAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC EndpointEPSS 2.7%CVE-2011-2195—A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoEPSS 2.7%CVE-2022-24392HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.7%CVE-2022-24393HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.7%CVE-2025-56108HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 2.7%