Falhas do tipo CWE-78
4.606 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-81468CRITICALDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command EPSS 2.0%CVE-2025-56083HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 2.0%CVE-2025-46271CRITICALPlanet Technology Network Products OS Command InjectionEPSS 2.0%CVE-2025-45491CRITICALLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the usernaEPSS 2.0%CVE-2025-34514HIGHIlevia EVE X1 Server 4.7.18.0.eden Authenticated Command InjectionEPSS 2.0%CVE-2026-13561MEDIUMEdimax EW-7478APC POST Request formiNICbasic os command injectionEPSS 2.0%CVE-2026-12815MEDIUMcoollabsio coolify Image Name os command injectionEPSS 2.0%CVE-2026-13560MEDIUMEdimax EW-7478APC POST Request formAccept os command injectionEPSS 2.0%CVE-2026-13581MEDIUMEdimax EW-7478APC POST Request formStaDrvSetup os command injectionEPSS 2.0%CVE-2026-9437MEDIUMDTStack Taier REST API Runtime.exec os command injectionEPSS 2.0%CVE-2026-9424MEDIUMEdimax EW-7438RPn Content-Type formWlanMP os command injectionEPSS 2.0%CVE-2026-15496MEDIUMSonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injectionEPSS 2.0%CVE-2026-12814MEDIUMComfast CF-WR631AX V3 API Endpoint mbox-config system os command injectionEPSS 2.0%CVE-2025-29269CRITICALALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoinEPSS 2.0%CVE-2022-3210HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routerEPSS 2.0%CVE-2026-18587HIGHWavlink WL-NU516U1 Config Import os command injectionEPSS 2.0%CVE-2026-30703CRITICALA command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The EPSS 2.0%CVE-2025-56096HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 2.0%CVE-2020-5350HIGHDell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM componenEPSS 2.0%CVE-2026-53611CRITICALLooking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input ValidationEPSS 2.0%