Weaknesses of type CWE-77

2,808 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2025-1536MEDIUMRaisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injectionEPSS 3.2%CVE-2024-37569HIGHAn issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the EPSS 3.2%CVE-2026-7692MEDIUMWavlink WL-WN570HA1 adm.cgi ping_ddns command injectionEPSS 3.2%CVE-2026-7691MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_cmd command injectionEPSS 3.2%CVE-2024-38288HIGHA command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attaEPSS 3.2%CVE-2024-5355MEDIUManji-plus AJ-Report IGroovyHandler command injectionEPSS 3.2%CVE-2026-6989MEDIUMTenda F453 Telnet Service telnet TendaTelnet command injectionEPSS 3.2%CVE-2025-5515MEDIUMTOTOLINK X2000R formMapDel command injectionEPSS 3.2%CVE-2023-31746CRITICALThere is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploitEPSS 3.2%CVE-2024-23628CRITICALMotorola MR2600 SaveStaticRouteIPv6Params Command Injection VulnerabilityEPSS 3.2%CVE-2025-4032LOWinclusionAI AWorld shell_tool.py subprocess.Popen os command injectionEPSS 3.2%CVE-2025-6775MEDIUMxiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injectionEPSS 3.2%CVE-2023-0646MEDIUMdst-admin cavesConsole command injectionEPSS 3.2%CVE-2023-0649MEDIUMdst-admin sendBroadcast command injectionEPSS 3.2%CVE-2026-7833HIGHEFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injectionEPSS 3.2%CVE-2026-8344MEDIUMD-Link DIR-816 formDMZ.cgi sub_445E7C command injectionEPSS 3.2%CVE-2026-8345MEDIUMD-Link DIR-816 singlePortForward sub_445E7C command injectionEPSS 3.2%CVE-2025-60700MEDIUMA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binarEPSS 3.2%CVE-2025-60701MEDIUMA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. ThEPSS 3.2%CVE-2024-7214MEDIUMTOTOLINK LR350 cstecgi.cgi setWanCfg command injectionEPSS 3.2%