Weaknesses of type CWE-77

2,961 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2026-2167MEDIUMTotolink WA300 cstecgi.cgi setAPNetwork os command injectionEPSS 2.5%CVE-2026-101858MEDIUMRaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injectionEPSS 2.5%CVE-2025-6620MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionEPSS 2.5%CVE-2025-6621MEDIUMTOTOLINK CA300-PoE ap.so QuickSetting os command injectionEPSS 2.5%CVE-2025-6618MEDIUMTOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionEPSS 2.5%CVE-2025-6619MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionEPSS 2.5%CVE-2023-49428HIGHTenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.EPSS 2.5%CVE-2026-9343MEDIUMEdimax EW-7438RPn webs formWpsStart os command injectionEPSS 2.5%CVE-2026-9347MEDIUMEdimax EW-7438RPn webs formWizSurvey os command injectionEPSS 2.5%CVE-2024-21879HIGHURL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225EPSS 2.5%CVE-2024-32025CRITICALKohya_ss is vulnerable to a command injection in `group_images_gui.py` (`GHSL-2024-021`)EPSS 2.5%CVE-2026-78493MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 2.5%CVE-2026-78484MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 2.5%CVE-2023-27078CRITICALA command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted rEPSS 2.5%CVE-2026-102793CRITICALZiroom ZHOME A0101 set_time_zone command injectionEPSS 2.5%CVE-2025-69256HIGHserverless MCP Server vulnerable to command injection in list-projects toolEPSS 2.5%CVE-2023-31701HIGHTP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove.EPSS 2.5%CVE-2023-31700HIGHTP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd.EPSS 2.5%CVE-2023-51887CRITICALCommand Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in applicEPSS 2.5%CVE-2024-41316CRITICALTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancEPSS 2.5%