Weaknesses of type CWE-77

2,960 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2023-30258CRITICALCommand Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthentiEPSS 94.3%CVE-2024-55956CRITICALIn Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitEPSS 94.0%KEVCVE-2025-4008HIGHArbitrary Command Injection in Smartbedded MeteoBridgeEPSS 93.3%KEVCVE-2022-40022CRITICALMicrochip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.EPSS 92.5%CVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 91.4%KEVCVE-2024-11320MEDIUMCommand Injection leading to RCE via LDAP MisconfigurationEPSS 91.2%CVE-2023-47218MEDIUMQTS, QuTS hero, QuTScloudEPSS 89.9%CVE-2019-5420—A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically geneEPSS 89.3%CVE-2025-29635HIGHA command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remoteEPSS 87.9%KEVCVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 87.4%KEVCVE-2022-42904HIGHZoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.EPSS 83.1%CVE-2026-105134CRITICALAhsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionEPSS 81.8%KEVCVE-2022-40770HIGHZoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by highEPSS 81.3%CVE-2018-12465CRITICALRemote Code Execution in Micro Focus Secure Messaging GatewayEPSS 80.0%CVE-2023-20889HIGHAria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria OperatioEPSS 79.1%CVE-2023-26801CRITICALLB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a comEPSS 77.7%CVE-2021-42129—A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform EPSS 77.3%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%CVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2005-2773CRITICALHP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) EPSS 74.6%KEV