Falhas do tipo CWE-78
4.622 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-30818HIGHOS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53EPSS 2.6%CVE-2026-22227HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2EPSS 2.6%CVE-2025-30286HIGHColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%CVE-2026-22224HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2EPSS 2.6%CVE-2020-25847HIGHCommand Injection Vulnerability in QTS and QuTS heroEPSS 2.6%CVE-2026-32238CRITICALOpenEMR has Remote Code Execution in backup functionalityEPSS 2.6%CVE-2026-3037HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.6%CVE-2026-25721HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.6%CVE-2026-16766CRITICALCatalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render optionsEPSS 2.6%CVE-2026-85672CRITICALzerox 1.1.20 OS Command Injection via Document URL File ExtensionEPSS 2.6%CVE-2026-85696CRITICALSadTalker OS Command Injection via Audio FilenameEPSS 2.6%CVE-2020-7805—An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command inEPSS 2.6%CVE-2022-44930CRITICALD-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.EPSS 2.6%CVE-2025-56097HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands EPSS 2.6%CVE-2025-56114HIGHOS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafteEPSS 2.6%CVE-2025-56118HIGHOS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands viaEPSS 2.6%CVE-2025-56098HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 2.6%CVE-2024-57687CRITICALAn OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows reEPSS 2.6%CVE-2025-1339MEDIUMTOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injectionEPSS 2.6%CVE-2025-56102HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crEPSS 2.6%