Falhas do tipo CWE-78

4.611 resultados

Injeção de comando do sistema operacional

A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.

Exemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Como mitigar

Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.

CVE-2019-5072HIGHAn exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart DualEPSS 1.8%CVE-2026-7642MEDIUMpskill9 website-downloader MCP index.ts download_website os command injectionEPSS 1.8%CVE-2026-90621MEDIUMipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injectionEPSS 1.8%CVE-2026-6141MEDIUMdanielmiessler Personal_AI_Infrastructure parse_url.ts os command injectionEPSS 1.8%CVE-2026-7600MEDIUMArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injectionEPSS 1.8%CVE-2026-79623MEDIUMFishCodeTech Muteki Default Local Worker Backend settings.json os command injectionEPSS 1.8%CVE-2026-5831MEDIUMAgions taskflow-ai terminal_execute handlers.ts os command injectionEPSS 1.8%CVE-2026-15513MEDIUMWavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injectionEPSS 1.8%CVE-2026-7730MEDIUMprivsim mcp-test-runner MCP index.ts child_process.spawn os command injectionEPSS 1.8%CVE-2026-15033MEDIUMchristopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injectionEPSS 1.8%CVE-2026-91853MEDIUMTOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injectionEPSS 1.8%CVE-2026-18590MEDIUMWavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injectionEPSS 1.8%CVE-2021-28802—Command Injection Vulnerabilities in QTS and QuTS heroEPSS 1.8%CVE-2022-44251CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.EPSS 1.8%CVE-2022-44252CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.EPSS 1.8%CVE-2022-44249CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.EPSS 1.8%CVE-2021-28804—Command Injection Vulnerabilities in QTS and QuTS heroEPSS 1.8%CVE-2022-44250CRITICALTOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.EPSS 1.8%CVE-2021-1538MEDIUMCisco Common Services Platform Collector Command Injection VulnerabilityEPSS 1.8%CVE-2025-44882CRITICALA command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary coEPSS 1.8%