Falhas do tipo CWE-78
4.603 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-78541HIGHCommand Injection in Parent Control of TP-Link Archer BE3600 v1EPSS 2.3%CVE-2022-46649HIGHAcemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary sheEPSS 2.3%CVE-2026-38822HIGHIn openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulneEPSS 2.3%CVE-2026-36828HIGHA command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI compEPSS 2.3%CVE-2026-57999HIGHluci-app-tailscale-community - Command Injection via tailscale.do_login RPCEPSS 2.3%CVE-2025-5030LOWAckites KillWxapkg wxapkg File Parser unpack.go processFile os command injectionEPSS 2.3%CVE-2026-31195HIGHOS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router EPSS 2.3%CVE-2026-31196HIGHOS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre REPSS 2.3%CVE-2026-71925HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via getDetailEPSS 2.3%CVE-2026-71923HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via auth_setEPSS 2.3%CVE-2026-71910HIGHDrayTek VigorAP Multiple Models OS Command Injection via apautotestEPSS 2.3%CVE-2026-71929HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDevProtoEPSS 2.3%CVE-2026-71927HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via rebDeviceEPSS 2.3%CVE-2026-71906HIGHDrayTek VigorAP Multiple Models OS Command Injection via setLanEPSS 2.3%CVE-2026-71930HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setTimeEPSS 2.3%CVE-2026-71943HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDevNetEPSS 2.3%CVE-2026-71924HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via getVidEPSS 2.3%CVE-2026-71905HIGHDrayTek VigorAP Multiple Models OS Command Injection via ExportSettingsEPSS 2.3%CVE-2026-71918HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via webBackupActionEPSS 2.3%CVE-2026-71908HIGHDrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_testEPSS 2.3%