Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2026-10214MEDIUMzhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injectionEPSS 1.3%CVE-2026-10219MEDIUMnextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionEPSS 1.3%CVE-2015-20108CRITICALxml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not useEPSS 1.3%CVE-2019-11279HIGHPrivilege Escalation via Scope Manipulation in UAAEPSS 1.3%CVE-2024-34352MEDIUMArbitrary file write vulnerability in 1Panel EPSS 1.3%CVE-2024-35285CRITICALA vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injectEPSS 1.3%CVE-2025-14204MEDIUMTykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injectionEPSS 1.3%CVE-2026-32063MEDIUMOpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit GenerationEPSS 1.3%CVE-2023-1000MEDIUMcyanomiko dcnnt-py Notification notifications.py main command injectionEPSS 1.3%CVE-2024-30213HIGHStoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, lEPSS 1.3%CVE-2024-29949HIGHThere is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execEPSS 1.3%CVE-2026-36540HIGHNetis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password EPSS 1.3%CVE-2021-39217HIGHOpenMage LTS arbitrary command execution in custom layout update through blocksEPSS 1.3%CVE-2025-9654MEDIUMAiondaDotCom mcp-ssh server-simple.mjs command injectionEPSS 1.3%CVE-2024-39571HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to commaEPSS 1.3%CVE-2024-53615MEDIUMA command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remotEPSS 1.3%CVE-2025-45492MEDIUMNetgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.EPSS 1.3%CVE-2023-20026MEDIUMA vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allEPSS 1.3%CVE-2023-27407CRITICALA vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properlyEPSS 1.3%CVE-2024-43027HIGHDrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discoveredEPSS 1.3%