Weaknesses of type CWE-77

2,807 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2024-55956CRITICALIn Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitEPSS 94.0%KEVCVE-2025-4008HIGHArbitrary Command Injection in Smartbedded MeteoBridgeEPSS 93.7%KEVCVE-2022-40022CRITICALMicrochip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.EPSS 92.5%CVE-2019-5420—A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically geneEPSS 92.1%CVE-2024-11320MEDIUMCommand Injection leading to RCE via LDAP MisconfigurationEPSS 91.0%CVE-2023-47218MEDIUMQTS, QuTS hero, QuTScloudEPSS 89.9%CVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 88.0%KEVCVE-2025-29635HIGHA command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remoteEPSS 87.9%KEVCVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 83.6%KEVCVE-2022-42904HIGHZoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.EPSS 83.1%CVE-2022-40770HIGHZoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by highEPSS 81.3%CVE-2018-12465CRITICALRemote Code Execution in Micro Focus Secure Messaging GatewayEPSS 80.0%CVE-2023-20889HIGHAria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria OperatioEPSS 79.3%CVE-2021-42129—A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform EPSS 77.3%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%CVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2005-2773CRITICALHP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) EPSS 74.6%KEVCVE-2021-4045CRITICALTP-LINK Tapo C200 remote code execution vulnerabilityEPSS 72.4%CVE-2025-4009CRITICALUnauthenticated Arbitrary Command Injection in Evertz SDVNEPSS 71.4%CVE-2024-22729CRITICALNETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.EPSS 70.8%