Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2023-27848CRITICALbroccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.EPSS 1.9%CVE-2023-35932HIGHjcvi vulnerable to Configuration Injection due to unsanitized user input EPSS 1.9%CVE-2023-46416HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 funcEPSS 1.9%CVE-2023-46414HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 functionEPSS 1.9%CVE-2023-46415HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.EPSS 1.9%CVE-2023-46419HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.EPSS 1.9%CVE-2023-46418HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.EPSS 1.9%CVE-2023-46417HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.EPSS 1.9%CVE-2023-46422HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.EPSS 1.9%CVE-2023-46424HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.EPSS 1.9%CVE-2023-46421HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.EPSS 1.9%CVE-2023-46420HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.EPSS 1.9%CVE-2023-46423HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.EPSS 1.9%CVE-2023-4310—BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability whicEPSS 1.8%CVE-2025-45489MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostnaEPSS 1.8%CVE-2022-40752CRITICALIBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-FEPSS 1.8%CVE-2025-50757MEDIUMWavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. ThisEPSS 1.8%CVE-2023-34233HIGHSnowflake Python Connector vulnerable to Command InjectionEPSS 1.8%CVE-2024-11634CRITICALCommand injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authentiEPSS 1.8%CVE-2021-3855HIGHCommand Injection in Liman Central Management SystemEPSS 1.8%