Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2024-35340HIGHTenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommaEPSS 1.2%CVE-2022-21810HIGHAll versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization. EPSS 1.2%CVE-2020-8101MEDIUMCommand execution due to unsanitized input in LifeShield DIY HD Video DoorbellEPSS 1.2%CVE-2025-56799MEDIUMReolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted foldeEPSS 1.2%CVE-2022-25350HIGHAll versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. EPSS 1.2%CVE-2023-6940CRITICALCommand InjectionEPSS 1.2%CVE-2023-27224CRITICALAn issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file.EPSS 1.2%CVE-2021-32933CRITICALMDT AutoSave Command InjectionEPSS 1.2%CVE-2025-45798MEDIUMA command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg inEPSS 1.2%CVE-2026-54501CRITICALBrowsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom BehaviorsEPSS 1.2%CVE-2022-41617HIGHBIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617EPSS 1.2%CVE-2024-39373CRITICALImproper Neutralization of Special Elements used in a Command in TELSAT marKoni FM TransmitterEPSS 1.2%CVE-2021-32661MEDIUMTechDocs object element script injectionEPSS 1.2%CVE-2023-30353CRITICALShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.EPSS 1.2%CVE-2024-38894MEDIUMWAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi.EPSS 1.2%CVE-2025-27212CRITICALAn Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi AccesEPSS 1.2%CVE-2025-53104CRITICALgluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action WorkflowEPSS 1.2%CVE-2025-60854CRITICALA vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change rEPSS 1.2%CVE-2024-53700MEDIUMQHoraEPSS 1.2%CVE-2026-30625CRITICALUpsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users toEPSS 1.2%