Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2024-45682HIGHMillbeck Communications Proroute H685t-w Command Injection.EPSS 2.0%CVE-2025-67511CRITICALCybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolEPSS 2.0%CVE-2018-0344—A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticaEPSS 2.0%CVE-2023-29798CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTraceroEPSS 2.0%CVE-2023-29801CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServEPSS 2.0%CVE-2026-1601MEDIUMTotolink A7000R cstecgi.cgi setUploadUserData command injectionEPSS 2.0%CVE-2023-29802CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfgEPSS 2.0%CVE-2023-29800CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirEPSS 2.0%CVE-2022-20801MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilitiesEPSS 2.0%CVE-2024-50591HIGHLocal Privilege Escalation via Command InjectionEPSS 2.0%CVE-2025-11045MEDIUMWAYOS LQ_04/LQ_05/LQ_06/LQ_07/LQ_09 usb_paswd.asp command injectionEPSS 2.0%CVE-2026-9296MEDIUMEdimax BR-6428NS POST Request formWlanM system command injectionEPSS 2.0%CVE-2026-9424MEDIUMEdimax EW-7438RPn Content-Type formWlanMP os command injectionEPSS 2.0%CVE-2026-9359MEDIUMEdimax EW-7438RPn POST Request formHwSet command injectionEPSS 2.0%CVE-2026-13581MEDIUMEdimax EW-7478APC POST Request formStaDrvSetup os command injectionEPSS 2.0%CVE-2026-9379MEDIUMEdimax BR-6675nD POST Request formWpsStart command injectionEPSS 2.0%CVE-2026-9440MEDIUMEdimax BR-6478AC POST Request formAccept command injectionEPSS 2.0%CVE-2026-12808MEDIUMEdimax BR-6478AC V2 POST Request stainfo command injectionEPSS 2.0%CVE-2026-9361MEDIUMEdimax EW-7438RPn POST Request formAccep formAccept command injectionEPSS 2.0%CVE-2026-15496MEDIUMSonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injectionEPSS 2.0%