Fallos del tipo CWE-77
2808 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2017-0915—Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote cEPSS 5.5%CVE-2017-0916—Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component rEPSS 5.5%CVE-2025-5440MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 NTP os command injectionEPSS 5.5%CVE-2025-5439MEDIUMLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 verifyFacebookLike os command injectionEPSS 5.5%CVE-2026-2081MEDIUMD-Link DIR-823X set_password os command injectionEPSS 5.5%CVE-2025-52046CRITICALTotolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and deEPSS 5.5%CVE-2024-8211MEDIUMD-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R1_DiskMGR command injectionEPSS 5.4%CVE-2025-24293CRITICAL# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe imageEPSS 5.4%CVE-2025-10629MEDIUMD-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injectionEPSS 5.4%CVE-2025-1800MEDIUMD-Link DAR-7000 HTTP POST Request sxh_vpnlic.php get_ip_addr_details command injectionEPSS 5.4%CVE-2024-48419HIGHEdimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can EPSS 5.4%CVE-2025-9581MEDIUMComfast CF-N1 webmgnt multi_pppoe command injectionEPSS 5.3%CVE-2025-9582MEDIUMComfast CF-N1 webmgnt ntp_timezone command injectionEPSS 5.3%CVE-2026-1506HIGHD-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injectionEPSS 5.3%CVE-2026-5353MEDIUMTrendnet TEW-657BRM setup.cgi ping_test os command injectionEPSS 5.2%CVE-2026-5354MEDIUMTrendnet TEW-657BRM setup.cgi vpn_connect os command injectionEPSS 5.2%CVE-2026-5355MEDIUMTrendnet TEW-657BRM setup.cgi vpn_drop os command injectionEPSS 5.2%CVE-2025-7836MEDIUMD-Link DIR-816L Environment Variable cgibin lxmldbc_system command injectionEPSS 5.2%CVE-2025-9262MEDIUMwong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionEPSS 5.2%CVE-2024-39765CRITICALMultiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505EPSS 5.2%