Web Vulnerabilities
OS Command Injection
Also: shell injection, CWE-78
A flaw where input reaches a shell command line and adds commands of its own.
In more detail
Shells treat characters such as semicolons, pipes and backticks as instructions. If a program builds a command string from input and hands it to a shell, those characters can end the intended command and begin another, which then runs with the program's permissions. The fix is to avoid the shell: pass an argument list directly to the program.