Fallos del tipo CWE-77
2807 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-4999CRITICALLigowave Unity/Pro/Mimo/APC Arbitrary Command InjectionEPSS 12.2%CVE-2025-1829MEDIUMTOTOLINK X18 cstecgi.cgi setMtknatCfg os command injectionEPSS 12.1%CVE-2025-14106HIGHZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injectionEPSS 12.1%CVE-2024-55544HIGHAuthenticated Command InjectionEPSS 12.0%CVE-2026-2615HIGHWavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injectionEPSS 12.0%CVE-2026-20841HIGHWindows Notepad App Remote Code Execution VulnerabilityEPSS 11.8%CVE-2026-3066MEDIUMHummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injectionEPSS 11.8%CVE-2025-10440MEDIUMD-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injectionEPSS 11.8%CVE-2025-10441MEDIUMD-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injectionEPSS 11.8%CVE-2018-14649CRITICALIt was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is donEPSS 11.7%CVE-2026-9441MEDIUMEdimax BR-6478AC POST Request formiNICbasic command injectionEPSS 11.7%CVE-2024-39360CRITICALAn os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craEPSS 11.7%CVE-2026-0732MEDIUMD-Link DI-8200G upgrade_filter.asp command injectionEPSS 11.7%CVE-2025-52690HIGHCommand Injection Vulnerability in the OmniAccess Stellar over UDP ServiceEPSS 11.6%CVE-2025-6299MEDIUMTOTOLINK N150RT formWSC os command injectionEPSS 11.6%CVE-2024-37642CRITICALTRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /foEPSS 11.4%CVE-2025-15137HIGHTRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934 command injectionEPSS 11.4%CVE-2020-8298—fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, anEPSS 11.2%CVE-2025-45488MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailexEPSS 11.1%CVE-2023-22884CRITICALApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowEPSS 11.1%