Fallos del tipo CWE-77

2960 resultados

Injeção de comando via entrada não sanitizada

O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.

Ejemplo

Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.

Cómo mitigar

Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.

CVE-2025-9586MEDIUMComfast CF-N1 webmgnt wireless_device_dissoc command injectionEPSS 7.5%CVE-2025-9584MEDIUMComfast CF-N1 webmgnt update_interface_png command injectionEPSS 7.5%CVE-2024-8212MEDIUMD-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_2nd_DiskMGR command injectionEPSS 7.5%CVE-2024-8210MEDIUMD-Link DNS-1550-04 hd_config.cgi sprintf command injectionEPSS 7.5%CVE-2025-2701MEDIUMAMTT Hotel Broadband Operation System port_setup.php popen os command injectionEPSS 7.4%CVE-2025-10961MEDIUMWavlink NU516U1 Delete_Mac_list wireless.cgi sub_4030C0 command injectionEPSS 7.4%CVE-2026-4253MEDIUMTenda AC8 Web UploadCfg route_set_user_policy_rule os command injectionEPSS 7.4%CVE-2026-8273MEDIUMD-Link DNS-320 system_mgr.cgi cgi_merge_user os command injectionEPSS 7.4%CVE-2023-51835MEDIUMAn issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_ping in the /boafrm/formEPSS 7.3%CVE-2025-0798CRITICALMicroWorld eScan Antivirus Quarantine rtscanner os command injectionEPSS 7.3%CVE-2024-23625CRITICALD-Link DAP-1650 SUBSCRIBE Callback Command Injection VulnerabilityEPSS 7.3%CVE-2025-14648MEDIUMDedeBIZ catalog_add.php command injectionEPSS 7.3%CVE-2020-15642HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole EPSS 7.2%CVE-2024-8213MEDIUMD-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_1st_DiskMGR command injectionEPSS 7.2%CVE-2025-13797MEDIUMADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injectionEPSS 7.2%CVE-2024-23624CRITICALD-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection VulnerabilityEPSS 7.1%CVE-2024-51027MEDIUMRuijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter.EPSS 7.1%CVE-2026-2188HIGHUTT 进取 521G formPdbUpConfig sub_446B18 os command injectionEPSS 7.1%CVE-2025-13798MEDIUMADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injectionEPSS 7.1%CVE-2025-12296MEDIUMD-Link DAP-2695 Firmware Update sub_4174B0 os command injectionEPSS 7.0%