Weaknesses of type CWE-77

2,960 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2024-32026CRITICALKohya_ss is vulnerable to a command injection in `git_caption_gui.py` (`GHSL-2024-020`)EPSS 3.0%CVE-2024-32027CRITICALKohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`)EPSS 3.0%CVE-2025-64052MEDIUMAn issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commanEPSS 3.0%CVE-2018-0350—A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbiEPSS 3.0%CVE-2023-24583HIGHTwo OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially cEPSS 3.0%CVE-2023-24582HIGHTwo OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially cEPSS 3.0%CVE-2024-7160MEDIUMTOTOLINK A3700R cstecgi.cgi setWanCfg command injectionEPSS 3.0%CVE-2026-7687MEDIUMlangflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injectionEPSS 3.0%CVE-2026-1625MEDIUMD-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injectionEPSS 3.0%CVE-2026-1624MEDIUMD-Link DWR-M961 formLtefotaUpgradeFibocom command injectionEPSS 3.0%CVE-2026-5333MEDIUMDefaultFuction Content-Management-System tools.php command injectionEPSS 3.0%CVE-2025-1369LOWMicroWord eScan Antivirus USB Password os command injectionEPSS 3.0%CVE-2025-5525MEDIUMJrohy trojan linux.go LogChan os command injectionEPSS 3.0%CVE-2026-94097CRITICALNetcore NBR200V2 CGI Diagnostic Endpoint network_tools command injectionEPSS 3.0%CVE-2026-7693HIGHBackup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' ParameterEPSS 3.0%CVE-2023-22671CRITICALGhidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injectioEPSS 2.9%CVE-2026-86149CRITICALTenda CP3 NetCheckPing.cpp os command injectionEPSS 2.9%CVE-2026-86148CRITICALTenda CP3 Kylin system.c SystemAsh os command injectionEPSS 2.9%CVE-2026-86151CRITICALTenda CP3 Network Configuration Management system.c sub_2F77E8 os command injectionEPSS 2.9%CVE-2025-24150HIGHA privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 1EPSS 2.9%