Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2025-59741CRITICALMultiple vulnerabilities in AndSoft's e-TMSEPSS 1.3%CVE-2023-51707CRITICALMotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x aEPSS 1.3%CVE-2023-48791HIGHAn improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, EPSS 1.3%CVE-2024-28135MEDIUMPHOENIX CONTACT: command injection vulnerability in the API of the CHARX SeriesEPSS 1.3%CVE-2026-10127MEDIUMEdimax BR-6478AC POST Request formStaDrvSetup command injectionEPSS 1.3%CVE-2024-37023CRITICALVonets WiFi Bridges Command InjectionEPSS 1.3%CVE-2025-23196HIGHApache Ambari: Code Injection Vulnerability in Ambari Alert DefinitionEPSS 1.3%CVE-2023-24184CRITICALTOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.EPSS 1.3%CVE-2020-22662HIGHIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, RuckusEPSS 1.3%CVE-2026-42258MEDIUMnet-imap: Command Injection via unvalidated Symbol inputsEPSS 1.3%CVE-2024-11665HIGHUnauthenticated Remote Command InjectionEPSS 1.3%CVE-2026-67323HIGHGitPython before 3.1.51 Command Injection via unguarded Git optionsEPSS 1.3%CVE-2025-37089HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2023-29855HIGHWBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.EPSS 1.2%CVE-2025-37092HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2026-1735LOWYealink MeetingBar A30 Diagnostic command injectionEPSS 1.2%CVE-2025-23094HIGHThe Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, EPSS 1.2%CVE-2025-37096HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2025-46427HIGHDell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('CommaEPSS 1.2%CVE-2024-37091CRITICALWordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerabilityEPSS 1.2%