Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-39759CRITICALMultiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A spEPSS 8.4%CVE-2026-2952MEDIUMVaelsys HTTP POST Request tree_server.php os command injectionEPSS 8.4%CVE-2025-2725HIGHH3C Magic BE18000 HTTP POST Request auth command injectionEPSS 8.3%CVE-2025-13306MEDIUMD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injectionEPSS 8.3%CVE-2024-8131MEDIUMD-Link DNS-1550-04 HTTP POST Request apkg_mgr.cgi module_enable_disable command injectionEPSS 8.2%CVE-2023-31986CRITICALA Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setEPSS 8.2%CVE-2024-2982MEDIUMTenda FH1202 WriteFacMac formWriteFacMac command injectionEPSS 8.2%CVE-2024-38227HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 8.2%CVE-2026-6992HIGHLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionEPSS 8.1%CVE-2023-31985CRITICALA Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the forEPSS 8.1%CVE-2026-8229MEDIUMWavlink NU516U1 wireless.cgi WifiBasic os command injectionEPSS 8.1%CVE-2026-8230MEDIUMWavlink NU516U1 login.cgi sys_login1 os command injectionEPSS 8.1%CVE-2026-8227MEDIUMWavlink NU516U1 adm.cgi wzdapMesh os command injectionEPSS 8.1%CVE-2024-8128MEDIUMD-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_add_zip command injectionEPSS 8.0%CVE-2025-5695MEDIUMTeledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injectionEPSS 8.0%CVE-2024-8134MEDIUMD-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_Std2R5_1st_DiskMGR command injectionEPSS 7.9%CVE-2024-8130MEDIUMD-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injectionEPSS 7.9%CVE-2024-8133MEDIUMD-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_R5_SpareDsk_DiskMGR command injectionEPSS 7.9%CVE-2026-52806CRITICALGogs: RCE via git rebase --exec argument injection in pull request mergeEPSS 7.9%CVE-2024-3009MEDIUMTenda FH1205 WriteFacMac formWriteFacMac command injectionEPSS 7.9%