Falhas do tipo CWE-78

4.604 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2024-6342CRITICAL**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAEPSS 2.1%CVE-2025-29631CRITICALGardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow commandEPSS 2.1%CVE-2023-30053CRITICALTOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.EPSS 2.1%CVE-2018-19950—If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP SystEPSS 2.1%CVE-2023-30054CRITICALTOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a speciallyEPSS 2.1%CVE-2026-90619MEDIUM0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injectionEPSS 2.1%CVE-2026-7220MEDIUMjackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injectionEPSS 2.1%CVE-2026-5692MEDIUMTotolink A7100RU cstecgi.cgi setGameSpeedCfg os command injectionEPSS 2.1%CVE-2026-7066MEDIUMchoieastsea simple-openstack-mcp server.py exec_openstack os command injectionEPSS 2.1%CVE-2026-5688MEDIUMTotolink A7100RU cstecgi.cgi setDdnsCfg os command injectionEPSS 2.1%CVE-2026-7064MEDIUMAgentDeskAI browser-tools-mcp browser-connector.ts os command injectionEPSS 2.1%CVE-2026-7590MEDIUMeyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injectionEPSS 2.1%CVE-2026-7593MEDIUMSunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injectionEPSS 2.1%CVE-2026-5678MEDIUMTotolink A7100RU cstecgi.cgi setScheduleCfg os command injectionEPSS 2.1%CVE-2026-5691MEDIUMTotolink A7100RU cstecgi.cgi setFirewallType os command injectionEPSS 2.1%CVE-2026-7785MEDIUMA-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injectionEPSS 2.1%CVE-2026-5690MEDIUMTotolink A7100RU cstecgi.cgi setRemoteCfg os command injectionEPSS 2.1%CVE-2026-5677MEDIUMTotolink A7100RU cstecgi.cgi CsteSystem os command injectionEPSS 2.1%CVE-2026-9452MEDIUMFoundDream miniclawd exec.ts ExecTool.execute os command injectionEPSS 2.1%CVE-2026-6158MEDIUMTotolink N300RH upgrade.so setUpgradeUboot os command injectionEPSS 2.1%