Weaknesses of type CWE-77

2,960 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2026-7833HIGHEFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injectionEPSS 3.2%CVE-2025-60700MEDIUMA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binarEPSS 3.2%CVE-2025-60701MEDIUMA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. ThEPSS 3.2%CVE-2024-7214MEDIUMTOTOLINK LR350 cstecgi.cgi setWanCfg command injectionEPSS 3.2%CVE-2024-20418CRITICALCisco Ultra-Reliable Wireless Backhaul Software Command Injection VulnerabilityEPSS 3.2%CVE-2026-79698CRITICALAdvantech WISE-6610-NB Node-RED nodered_lib_apply command injectionEPSS 3.2%CVE-2023-34153HIGHA vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-fEPSS 3.1%CVE-2024-52325MEDIUMECOVACS robot lawnmowers and vacuums command injectionEPSS 3.1%CVE-2023-0647MEDIUMdst-admin kickPlayer command injectionEPSS 3.1%CVE-2024-44402CRITICALD-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.EPSS 3.1%CVE-2024-32022CRITICALKohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)EPSS 3.1%CVE-2026-1689MEDIUMTenda HG10 Login formLogin checkUserFromLanOrWan command injectionEPSS 3.1%CVE-2024-44413HIGHA vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp functEPSS 3.1%CVE-2024-21322HIGHMicrosoft Defender for IoT Remote Code Execution VulnerabilityEPSS 3.1%CVE-2020-10519—Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerEPSS 3.1%CVE-2025-10107MEDIUMTRENDnet TEW-831DR formSysCmd command injectionEPSS 3.1%CVE-2025-11141MEDIUMRuijie NBR2100G-E branch_passw.php listAction os command injectionEPSS 3.1%CVE-2023-33533HIGHNetgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with FirEPSS 3.1%CVE-2022-46642CRITICALD-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgEPSS 3.1%CVE-2022-46641CRITICALD-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIEPSS 3.1%