Weaknesses of type CWE-77

2,808 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2022-32765CRITICALAn OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specialEPSS 3.5%CVE-2025-11490MEDIUMwonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injectionEPSS 3.5%CVE-2026-1326MEDIUMTotolink NR1800X POST Request cstecgi.cgi setWanCfg command injectionEPSS 3.5%CVE-2026-1802MEDIUMZiroom ZHOME A0101 zrMacClone.lua macAddrClone command injectionEPSS 3.5%CVE-2024-23626CRITICALMotorola MR2600 SaveSysLogParams Command Injection VulnerabilityEPSS 3.5%CVE-2024-23627CRITICALMotorola MR2600 SaveStaticRouteIPv4Params Command Injection VulnerabilityEPSS 3.5%CVE-2020-3211HIGHCisco IOS XE Software Web UI Command Injection VulnerabilityEPSS 3.5%CVE-2025-60673MEDIUMAn unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in EPSS 3.5%CVE-2026-4499MEDIUMD-Link DIR-820LW SSDP ssdpcgi_main os command injectionEPSS 3.5%CVE-2019-16005HIGHCisco Webex Video Mesh Node Command Injection VulnerabilityEPSS 3.5%CVE-2016-6558—The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injectionEPSS 3.5%CVE-2025-60676MEDIUMAn unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in EPSS 3.5%CVE-2026-1544MEDIUMD-Link DIR-823X set_mode sub_41E2A0 os command injectionEPSS 3.5%CVE-2023-30400CRITICALAn issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration scriptEPSS 3.5%CVE-2026-2193MEDIUMD-Link DI-7100G C1 set_jhttpd_info command injectionEPSS 3.5%CVE-2026-4468MEDIUMComfast CF-AC100 mbox-config command injectionEPSS 3.4%CVE-2026-4591MEDIUMkalcaddle kodbox fileThumb Endpoint app.php checkBin os command injectionEPSS 3.4%CVE-2023-22371HIGHAn os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafteEPSS 3.4%CVE-2026-6987MEDIUMPicoClaw Web Launcher Management Plane restart command injectionEPSS 3.4%CVE-2025-5606MEDIUMTenda AC18 SetIPTVCfg formSetIptv command injectionEPSS 3.4%