Falhas do tipo CWE-78
4.563 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2025-1316CRITICALEdimax IC-7100 IP Camera OS Command InjectionEPSS 74.5%KEVCVE-2023-23076CRITICALOS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.EPSS 74.3%CVE-2017-5255—In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console EPSS 74.2%CVE-2019-12991HIGHCitrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).EPSS 74.1%KEVCVE-2026-2041HIGHNagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution VulnerabilityEPSS 73.7%CVE-2026-2043HIGHNagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution VulnerabilityEPSS 73.7%CVE-2024-9916MEDIUMHuangDou UTCMS cli.php os command injectionEPSS 73.6%CVE-2023-47565HIGHLegacy VioStor NVREPSS 73.3%KEVCVE-2017-6334HIGHdnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands EPSS 72.6%KEVCVE-2022-34753HIGHA CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rEPSS 71.3%CVE-2021-4039CRITICALA command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS comEPSS 71.0%CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2022-44456CRITICALCONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server wEPSS 69.9%CVE-2021-21805CRITICALAn OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially cEPSS 69.8%CVE-2023-3368CRITICALChamilo LMS Unauthenticated Command InjectionEPSS 69.7%CVE-2016-11021HIGHsetSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand paraEPSS 68.9%KEVCVE-2017-6077CRITICALping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via sEPSS 68.7%KEVCVE-2025-34152CRITICALShenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time ParameterEPSS 68.6%CVE-2023-30806CRITICALSangfor Next-Gen Application Firewall PHPSESSID Command InjectionEPSS 65.8%CVE-2023-30805CRITICALSangfor Next-Gen Application Firewall Login Un Param Command InjectionEPSS 65.8%