Falhas do tipo CWE-78

4.602 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2025-34049CRITICALOptiLink ONT1GEW GPON Remote Code ExecutionEPSS 2.4%CVE-2020-8273—Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8.EPSS 2.4%CVE-2025-56087HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 2.4%CVE-2022-50909HIGHAlgo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)EPSS 2.4%CVE-2021-21954CRITICALA command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 EPSS 2.4%CVE-2023-3991CRITICALOS command injection vulnerability in FreshTomato 2023.3EPSS 2.4%CVE-2026-67608HIGHTelenia TVox 26.5.3 OS Command Injection via action_audio.phpEPSS 2.4%CVE-2026-67599HIGHClearOS 7.9 OS Command Injection via Log Viewer filter parameterEPSS 2.4%CVE-2021-21302MEDIUMCSV Injection via csv exportEPSS 2.4%CVE-2026-40520HIGHFreePBX api module Command Injection via GraphQLEPSS 2.4%CVE-2026-32833HIGHCudy LT300 3.0 OS Command Injection via NTP ConfigurationEPSS 2.4%CVE-2025-1676MEDIUMhzmanyun Education and Training System pdf2swf os command injectionEPSS 2.4%CVE-2022-25171HIGHCommand InjectionEPSS 2.4%CVE-2026-66297MEDIUMUnescaped deployment environment variables in generated setup commandsEPSS 2.4%CVE-2026-90492MEDIUMwebgjc web_robot web.py controller_recover os command injectionEPSS 2.4%CVE-2026-85542HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 2.4%CVE-2025-64126CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.4%CVE-2025-64128CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.4%CVE-2025-64127CRITICALZenitel TCIV-3+ OS Command InjectionEPSS 2.4%CVE-2023-40505CRITICALLG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution VulnerabilityEPSS 2.4%