Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2021-1547MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.6%CVE-2023-27581HIGHgithub-slug-action vulnerable to arbitrary code executionEPSS 1.6%CVE-2026-93966MEDIUMaiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injectionEPSS 1.6%CVE-2026-11450MEDIUMGL.iNet GL-MT3000 Path Normalization dlopen command injectionEPSS 1.6%CVE-2025-3546HIGHH3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.6%CVE-2019-14944MEDIUMAn issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows iEPSS 1.6%CVE-2025-59470CRITICALThis vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or oEPSS 1.6%CVE-2022-42897CRITICALArray Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and contEPSS 1.6%CVE-2023-35031HIGHAtos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 REPSS 1.6%CVE-2026-45663CRITICALDokploy: Remote Code Execution via destinationPath in Container File UploadEPSS 1.6%CVE-2023-24540CRITICALImproper handling of JavaScript whitespace in html/templateEPSS 1.6%CVE-2022-39243HIGHNuProcess vulnerable to command-line injection through insertion of NUL character(s)EPSS 1.6%CVE-2024-33342HIGHD-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to eEPSS 1.6%CVE-2024-29385CRITICALDIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.EPSS 1.6%CVE-2026-42453HIGHTermix: Command injection in extractArchive/compressFiles via double-quote escaping bypassEPSS 1.6%CVE-2022-40100CRITICALTenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.EPSS 1.6%CVE-2021-28812HIGHCommand Injection Vulnerability in Video StationEPSS 1.6%CVE-2026-44854HIGHAuthenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management InterfaceEPSS 1.6%CVE-2026-44853HIGHAuthenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management InterfaceEPSS 1.6%CVE-2026-5433CRITICALImproper sanitizationEPSS 1.6%