Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2024-57211HIGHTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_EPSS 1.2%CVE-2024-1356HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-25612HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-25611HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-25613HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-12912HIGHAn improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2EPSS 1.2%CVE-2021-41231HIGHOpenMage LTS DataFlow upload remote code execution vulnerabilityEPSS 1.2%CVE-2024-5914HIGHCortex XSOAR: Command Injection in CommonScripts PackEPSS 1.2%CVE-2024-10435MEDIUMdidi Super-Jacoco triggerEnvCov command injectionEPSS 1.2%CVE-2023-46485CRITICALAn issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of tEPSS 1.2%CVE-2026-11406MEDIUMGL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injectionEPSS 1.2%CVE-2023-46484CRITICALAn issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.EPSS 1.2%CVE-2024-40089CRITICALA Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code bEPSS 1.2%CVE-2023-23355MEDIUMQTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVREPSS 1.2%CVE-2025-23052HIGHAuthenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI InterfaceEPSS 1.2%CVE-2025-37133HIGHAuthenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage.EPSS 1.2%CVE-2026-16133LOWLiuMengxuan04 MiniCode mcp.ts child_process.spawn command injectionEPSS 1.2%CVE-2025-37134HIGHAuthenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceEPSS 1.2%CVE-2026-16763MEDIUMlocalstack serverless-localstack Configuration index.js os command injectionEPSS 1.2%CVE-2026-44872HIGHAuthenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management InterfaceEPSS 1.2%