Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2024-57227HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fuEPSS 1.2%CVE-2024-57226HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.EPSS 1.2%CVE-2024-57228HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.EPSS 1.2%CVE-2026-19039MEDIUMKino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injectionEPSS 1.2%CVE-2026-19978MEDIUMjiantao88 android-mcp-server Command Execution index.js child_process.exec os command injectionEPSS 1.2%CVE-2023-48702HIGHJellyfin Possible Remote Code Execution via custom FFmpeg binaryEPSS 1.2%CVE-2025-37091HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2026-12223MEDIUMYealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injectionEPSS 1.2%CVE-2024-43613HIGHAzure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2024-49042HIGHAzure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2025-59468CRITICALThis vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passworEPSS 1.2%CVE-2023-40263HIGHAn issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp.EPSS 1.2%CVE-2025-29209CRITICALTOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of EPSS 1.2%CVE-2024-2947HIGHCockpit: command injection when deleting a sosreport with a crafted nameEPSS 1.2%CVE-2025-4850MEDIUMTOTOLINK N300RH cstecgi.cgi setUnloadUserData command injectionEPSS 1.2%CVE-2022-34660MEDIUMA vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), TeamcenteEPSS 1.2%CVE-2023-26128HIGHAll versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sanEPSS 1.2%CVE-2025-4729MEDIUMTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionEPSS 1.2%CVE-2024-12992HIGHRemote Code Execution leads to Command InjectionEPSS 1.2%CVE-2024-38486HIGHDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special ElemenEPSS 1.2%