Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2019-5424—In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This EPSS 1.9%CVE-2024-44844HIGHDrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_commEPSS 1.9%CVE-2025-11073MEDIUMKeyfactor RG-EW5100BE HTTP POST Request cmd command injectionEPSS 1.9%CVE-2024-34204CRITICALTOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function vEPSS 1.9%CVE-2024-22900HIGHVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInEPSS 1.9%CVE-2023-34232HIGHSnowflake NodeJS Driver vulnerable to Command InjectionEPSS 1.9%CVE-2024-30891HIGHA command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput paraEPSS 1.9%CVE-2023-51972CRITICALTenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.EPSS 1.9%CVE-2019-5414—If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of thEPSS 1.9%CVE-2026-40135MEDIUMOS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 1.9%CVE-2023-2682MEDIUMCaton Live Mini_HTTPD ping.cgi command injectionEPSS 1.9%CVE-2024-22903HIGHVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK EPSS 1.9%CVE-2024-25082MEDIUMSplinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.EPSS 1.9%CVE-2024-35522HIGHNetgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.EPSS 1.9%CVE-2023-27079HIGHCommand Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted packageEPSS 1.9%CVE-2025-59689MEDIUMLibraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been releaseEPSS 1.9%KEVCVE-2025-45987CRITICALBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450EPSS 1.9%CVE-2023-25649MEDIUMOS Command Injection Vulnerability in a Mobile Internet Product of ZTEEPSS 1.9%CVE-2022-46640CRITICALNanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP requestEPSS 1.9%CVE-2022-46404CRITICALA command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.2EPSS 1.9%