Weaknesses of type CWE-77

2,960 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2026-4228MEDIUMLB-LINK BL-WR9000 set_wifi sub_458754 command injectionEPSS 12.9%CVE-2025-9745MEDIUMD-Link DI-500WF jhttpd version_upgrade.asp os command injectionEPSS 12.7%CVE-2022-26085CRITICALAn OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafteEPSS 12.7%CVE-2025-7414MEDIUMTenda O3V2 httpd setPingInfo fromNetToolGet os command injectionEPSS 12.6%CVE-2024-44335HIGHD-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2EPSS 12.4%CVE-2024-55544HIGHAuthenticated Command InjectionEPSS 12.4%CVE-2025-1829MEDIUMTOTOLINK X18 cstecgi.cgi setMtknatCfg os command injectionEPSS 12.4%CVE-2025-15048MEDIUMTenda WH450 HTTP Request CheckTools command injectionEPSS 12.3%CVE-2018-3786—A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command lineEPSS 12.3%CVE-2025-14107HIGHZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injectionEPSS 12.2%CVE-2024-4999CRITICALLigowave Unity/Pro/Mimo/APC Arbitrary Command InjectionEPSS 12.2%CVE-2025-7407MEDIUMNetgear D6400 diag.cgi os command injectionEPSS 12.1%CVE-2025-14106HIGHZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injectionEPSS 12.1%CVE-2024-39360CRITICALAn os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craEPSS 12.0%CVE-2018-14649CRITICALIt was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is donEPSS 12.0%CVE-2023-22884CRITICALApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowEPSS 11.9%CVE-2025-45488MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailexEPSS 11.7%CVE-2026-0732MEDIUMD-Link DI-8200G upgrade_filter.asp command injectionEPSS 11.7%CVE-2025-6299MEDIUMTOTOLINK N150RT formWSC os command injectionEPSS 11.6%CVE-2025-45487MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.EPSS 11.6%