İçeriğe atla
Noroxi

CWE-78 · 5.951 kayıt

İşletim sistemi komut enjeksiyonu

Neden olur?

Kullanıcı girdisi, bir kabuk komutunun içine metin olarak yerleştiriliyor. Kabuk, girdideki özel karakterleri komutun parçası olarak yorumlayabilir.

Hatalı ve düzeltilmiş kod

Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.

Hatalı

ts
const host = req.body.host;exec("ping -c 1 " + host, onResult);

Düzeltilmiş

ts
const host = req.body.host;if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);execFile("ping", ["-c", "1", host], onResult);

Nasıl önlenir?

  1. 01Kabuk üzerinden çalıştırmak yerine argümanları dizi olarak veren API’leri kullanın.
  2. 02Girdiyi izin listesiyle doğrulayın (örneğin yalnızca alan adı biçimi).
  3. 03Mümkünse işletim sistemi komutu yerine kütüphane işlevi kullanın.

Bu sınıftaki CVE’ler

5.960 kayıt

  • CVE-2026-10520
    100Hemen

    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %100

    ivanti · standalone sentry9 Haz 2026

  • CVE-2021-1498
    99Hemen

    Cisco HyperFlex HX Command Injection Vulnerabilities

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    cisco · hyperflex hx data platform6 May 2021

  • CVE-2014-6271
    99Hemen

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    gnu · bash24 Eyl 2014

  • CVE-2019-16920
    99Hemen

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    dlink · dir-655 firmware27 Eyl 2019

  • CVE-2022-44877
    99Hemen

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comma

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    control-webpanel · webpanel5 Oca 2023

  • CVE-2020-8515
    99Hemen

    DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code executi

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    draytek · vigor2960 firmware1 Şub 2020

  • CVE-2020-9054
    99Hemen

    ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    zyxel · nas326 firmware4 Mar 2020

  • CVE-2024-4577
    99Hemen

    Argument Injection in PHP-CGI

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    php · php9 Haz 2024

  • CVE-2020-25506
    99Hemen

    D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    dlink · dns-320 firmware2 Şub 2021

  • CVE-2019-10149
    99Hemen

    A flaw was found in Exim versions 4.87 to 4.91 (inclusive).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    exim · exim5 Haz 2019

  • CVE-2018-10562
    99Hemen

    An issue was discovered on Dasan GPON home routers.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    dasannetworks · gpon router firmware3 May 2018

  • CVE-2022-30525
    99Hemen

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    zyxel · usg flex 100w firmware12 May 2022

  • CVE-2014-7169
    99Hemen

    GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variabl

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    gnu · bash24 Eyl 2014

  • CVE-2021-1497
    99Hemen

    Cisco HyperFlex HX Command Injection Vulnerabilities

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    cisco · hyperflex hx data platform6 May 2021

  • CVE-2024-45519
    99Hemen

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    synacor · zimbra collaboration suite2 Eki 2024

  • CVE-2021-36260
    99Hemen

    A command injection vulnerability in the web server of some Hikvision product.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    hikvision · ds-2cd2026g2-iu\/sl firmware22 Eyl 2021

  • CVE-2021-35394
    99Hemen

    Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    realtek · rtl819x jungle software development kit16 Ağu 2021

  • CVE-2019-15107
    99Hemen

    An issue was discovered in Webmin <=1.920.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    webmin · webmin15 Ağu 2019

  • CVE-2020-16846
    99Hemen

    An issue was discovered in SaltStack Salt through 3002.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    saltstack · salt6 Kas 2020

  • CVE-2023-28771
    99Hemen

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    zyxel · atp100 firmware24 Nis 2023

  • CVE-2020-7247
    99Hemen

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    openbsd · opensmtpd29 Oca 2020

  • CVE-2024-9463
    99Hemen

    Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

    KritikCVSS 9,9KEVSilahlaştırılmışEPSS %99

    paloaltonetworks · expedition9 Eki 2024

  • CVE-2024-50603
    99Hemen

    An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    aviatrix · controller7 Oca 2025

  • CVE-2022-29303
    98Hemen

    SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    contec · sv-cpt-mc310 firmware12 May 2022

  • CVE-2023-25280
    98Hemen

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with t

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    dlink · dir-820l firmware15 Mar 2023

Tüm zafiyet sınıfları