Fallos del tipo CWE-77
2802 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-55956CRITICALIn Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitEPSS 94.0%KEVCVE-2025-4008HIGHArbitrary Command Injection in Smartbedded MeteoBridgeEPSS 93.7%KEVCVE-2022-40022CRITICALMicrochip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.EPSS 92.5%CVE-2019-5420—A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically geneEPSS 92.1%CVE-2024-11320MEDIUMCommand Injection leading to RCE via LDAP MisconfigurationEPSS 91.0%CVE-2023-47218MEDIUMQTS, QuTS hero, QuTScloudEPSS 89.9%CVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 88.0%KEVCVE-2025-29635HIGHA command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remoteEPSS 87.9%KEVCVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 83.6%KEVCVE-2022-42904HIGHZoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.EPSS 83.1%CVE-2022-40770HIGHZoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by highEPSS 81.3%CVE-2018-12465CRITICALRemote Code Execution in Micro Focus Secure Messaging GatewayEPSS 80.0%CVE-2023-20889HIGHAria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria OperatioEPSS 79.3%CVE-2021-42129—A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform EPSS 77.3%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%CVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2005-2773CRITICALHP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) EPSS 74.6%KEVCVE-2017-15889—Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to exEPSS 73.7%CVE-2021-4045CRITICALTP-LINK Tapo C200 remote code execution vulnerabilityEPSS 72.4%CVE-2025-4009CRITICALUnauthenticated Arbitrary Command Injection in Evertz SDVNEPSS 71.4%