Weaknesses of type CWE-77

2,808 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2023-0648MEDIUMdst-admin masterConsole command injectionEPSS 3.1%CVE-2024-2352MEDIUM1Panel swap baseApi.UpdateDeviceSwap command injectionEPSS 3.0%CVE-2020-2507CRITICALcommand injection vulnerability in HelpdeskEPSS 3.0%CVE-2024-52325MEDIUMECOVACS robot lawnmowers and vacuums command injectionEPSS 3.0%CVE-2026-4611HIGHTOTOLINK X6000R shttpd setLanCfg privilege escalationEPSS 3.0%CVE-2024-32026CRITICALKohya_ss is vulnerable to a command injection in `git_caption_gui.py` (`GHSL-2024-020`)EPSS 3.0%CVE-2024-32027CRITICALKohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`)EPSS 3.0%CVE-2023-24582HIGHTwo OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially cEPSS 3.0%CVE-2025-9935MEDIUMTOTOLINK N600R cstecgi.cgi sub_4159F8 command injectionEPSS 3.0%CVE-2018-0350—A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbiEPSS 3.0%CVE-2023-24583HIGHTwo OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially cEPSS 3.0%CVE-2026-6025CRITICALTotolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injectionEPSS 3.0%CVE-2024-7160MEDIUMTOTOLINK A3700R cstecgi.cgi setWanCfg command injectionEPSS 3.0%CVE-2022-44621CRITICALApache Kylin: Command injection by Diagnosis ControllerEPSS 3.0%CVE-2026-6028CRITICALTotolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injectionEPSS 3.0%CVE-2026-6029CRITICALTotolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injectionEPSS 3.0%CVE-2026-6026CRITICALTotolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injectionEPSS 3.0%CVE-2026-2169MEDIUMD-Link DWR-M921 formLtefotaUpgradeFibocom command injectionEPSS 3.0%CVE-2025-24150HIGHA privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 1EPSS 3.0%CVE-2025-53773HIGHGitHub Copilot and Visual Studio Remote Code Execution VulnerabilityEPSS 3.0%