Weaknesses of type CWE-77

2,960 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2025-9424MEDIUMRuijie WS7204-A branch_import.php os command injectionEPSS 15.2%CVE-2024-35397HIGHTOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the EPSS 15.1%CVE-2026-2534MEDIUMComfast CF-N1 V2 mbox-config sub_44AC4C command injectionEPSS 15.0%CVE-2026-9441MEDIUMEdimax BR-6478AC POST Request formiNICbasic command injectionEPSS 15.0%CVE-2024-35517HIGHNetgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.EPSS 15.0%CVE-2024-10428HIGHWAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injectionEPSS 15.0%CVE-2024-1781MEDIUMTotolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injectionEPSS 14.8%CVE-2025-5571MEDIUMD-Link DCS-932L setSystemAdmin os command injectionEPSS 14.7%CVE-2025-5573MEDIUMD-Link DCS-932L setSystemWizard setSystemControl os command injectionEPSS 14.7%CVE-2024-44400HIGHA vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp functEPSS 14.5%CVE-2025-52377MEDIUMCommand injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to exeEPSS 14.4%CVE-2025-52690HIGHCommand Injection Vulnerability in the OmniAccess Stellar over UDP ServiceEPSS 14.4%CVE-2026-3612HIGHWavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injectionEPSS 14.3%CVE-2023-47253CRITICALQualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.phEPSS 14.3%CVE-2023-23369CRITICALQTS, Multimedia Console, and Media Streaming add-onEPSS 14.1%CVE-2024-48286HIGHLinksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.EPSS 14.1%CVE-2023-33300MEDIUMA improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlEPSS 14.1%CVE-2025-5504MEDIUMTOTOLINK X2000R formWsc command injectionEPSS 14.0%CVE-2026-2670HIGHAdvantech WISE-6610-NB Background Management openvpn_apply os command injectionEPSS 13.9%CVE-2026-22755CRITICALLegacy Vivotek Camera Firmware Command Injection in upload_map.cgiEPSS 13.8%