Weaknesses of type CWE-77

2,960 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2023-33782HIGHD-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.EPSS 35.6%CVE-2021-1384MEDIUMCisco IOx for IOS XE Software Command Injection VulnerabilityEPSS 35.4%CVE-2024-12986MEDIUMDrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injectionEPSS 35.3%CVE-2020-2509CRITICALCommand Injection Vulnerability in QTS and QuTS heroEPSS 34.0%KEVCVE-2026-3065MEDIUMHummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injectionEPSS 33.1%CVE-2025-9769LOWD-Link DI-7400G+ mng_platform.asp sub_478D28 command injectionEPSS 33.0%CVE-2024-44334HIGHD-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400EPSS 31.8%CVE-2022-40881CRITICALSolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.phpEPSS 31.4%CVE-2023-51126CRITICALCommand injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value paramEPSS 31.1%CVE-2025-5447MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injectionEPSS 30.5%CVE-2020-7384HIGHClient-Side Command Injection in Rapid7 MetasploitEPSS 30.5%CVE-2024-11652MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injectionEPSS 30.2%CVE-2018-19949CRITICALIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue EPSS 30.2%KEVCVE-2024-11654MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injectionEPSS 29.1%CVE-2024-11659MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injectionEPSS 29.1%CVE-2024-11657MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injectionEPSS 29.1%CVE-2024-11653MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injectionEPSS 29.1%CVE-2024-11658MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injectionEPSS 29.1%CVE-2022-31161CRITICALRoxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert UploadEPSS 28.8%CVE-2024-11655MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injectionEPSS 28.8%