Falhas do tipo CWE-78
4.612 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-48782HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.7%CVE-2024-5720HIGHLogsign Unified SecOps Platform Command Injection Remote Code Execution VulnerabilityEPSS 2.7%CVE-2020-2014HIGHPAN-OS: OS injection vulnerability in PAN-OS management serverEPSS 2.7%CVE-2024-5719HIGHLogsign Unified SecOps Platform Command Injection Remote Code Execution VulnerabilityEPSS 2.7%CVE-2025-50195HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.phpEPSS 2.7%CVE-2026-19379MEDIUMEFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injectionEPSS 2.7%CVE-2026-18641MEDIUMSangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injectionEPSS 2.7%CVE-2025-50197HIGHChamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameterEPSS 2.7%CVE-2026-9367MEDIUMNousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injectionEPSS 2.7%CVE-2026-41247HIGHelFinder: Command injection in resize background color parameter when using ImageMagick CLIEPSS 2.7%CVE-2026-48687HIGHFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _logEPSS 2.7%CVE-2025-56129HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request toEPSS 2.6%CVE-2025-56123HIGHOS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary cEPSS 2.6%CVE-2025-56120HIGHOS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands viaEPSS 2.6%CVE-2025-56122HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands EPSS 2.6%CVE-2026-44454HIGHCoder vulnerable to workspace auto-creation via crafted URL parameters without user consentEPSS 2.6%CVE-2011-10026CRITICALSpreecommerce < 0.50.x API RCEEPSS 2.6%CVE-2025-49537HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%CVE-2026-10872HIGHShibby Tomato Web UI rc start_vpnserver os command injectionEPSS 2.6%CVE-2026-35196HIGHChamilo LMS has OS Command Injection via export_all_certificates actionEPSS 2.6%