Falhas do tipo CWE-78
4.604 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-4298HIGHHGiga iSherlock - Command InjectionEPSS 2.1%CVE-2023-34987HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.EPSS 2.1%CVE-2020-12148MEDIUMOS Command Injection - nslookup APIEPSS 2.1%CVE-2023-29944CRITICALMetersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom EPSS 2.1%CVE-2024-41314MEDIUMTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disableEPSS 2.1%CVE-2026-15428HIGHOS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800vEPSS 2.1%CVE-2026-6644CRITICALA command injection vulnerability was found in the PPTP VPN Clients on the ADMEPSS 2.1%CVE-2023-26155HIGHAll versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize EPSS 2.1%CVE-2024-42633HIGHA Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an aEPSS 2.1%CVE-2026-89308CRITICALArbitrary command execution in TrxTimeATTENDANCEEPSS 2.1%CVE-2020-3336HIGHCisco TelePresence Collaboration Endpoint and RoomOS Software Command Injection VulnerabilityEPSS 2.1%CVE-2019-17096CRITICALBitdefender BOX 2 bootstrap get_image_size command injection vulnerabilityEPSS 2.1%CVE-2021-21414HIGHCommand injection vulnerability in @prisma/sdk in getPackedPackage functionEPSS 2.1%CVE-2021-23031—On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x befoEPSS 2.1%CVE-2022-46631CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the settEPSS 2.1%CVE-2022-46634CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the settEPSS 2.1%CVE-2025-56130HIGHOS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a craftEPSS 2.1%CVE-2025-5106MEDIUMFujian Kelixun Filename fax_view.php os command injectionEPSS 2.1%CVE-2021-39826HIGHAdobe Digital Editions Command Execution VulnerabilityEPSS 2.1%CVE-2025-6103HIGHWifi-soft UniBox Controller test_accesscodelogin.php os command injectionEPSS 2.1%