Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2025-10960MEDIUMWavlink NU516U1 DeleteMac wireless.cgi sub_402D1C command injectionEPSS 5.6%CVE-2019-15588—There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code ExEPSS 5.6%CVE-2026-20186CRITICALCisco Identity Services Engine Multiple Authenticated Remote Code Execution VulnerabilityEPSS 5.6%CVE-2025-10325MEDIUMWavlink WL-WN578W2 login.cgi sub_401BA4 command injectionEPSS 5.6%CVE-2025-24293CRITICAL# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe imageEPSS 5.6%CVE-2026-1506HIGHD-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injectionEPSS 5.6%CVE-2026-3704MEDIUMWavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injectionEPSS 5.6%CVE-2025-9580MEDIUMLB-LINK BL-X26 HTTP set_blacklist os command injectionEPSS 5.5%CVE-2025-8818MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setLan setDFSSetting os command injectionEPSS 5.5%CVE-2026-13545HIGHD-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injectionEPSS 5.5%CVE-2025-5620MEDIUMD-Link DIR-816 setipsec_config os command injectionEPSS 5.5%CVE-2017-0915—Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote cEPSS 5.5%CVE-2017-0916—Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component rEPSS 5.5%CVE-2024-48419HIGHEdimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can EPSS 5.5%CVE-2026-10061MEDIUMTRENDnet TEW-432BRP formWPS command injectionEPSS 5.5%CVE-2026-10060MEDIUMTRENDnet TEW-432BRP formSetRoute command injectionEPSS 5.5%CVE-2026-1066MEDIUMkalcaddle kodbox Compression zip command injectionEPSS 5.5%CVE-2025-1800MEDIUMD-Link DAR-7000 HTTP POST Request sxh_vpnlic.php get_ip_addr_details command injectionEPSS 5.5%CVE-2026-7690MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_adm command injectionEPSS 5.5%CVE-2026-2152HIGHD-Link DIR-615 Web Configuration adv_routing.php os command injectionEPSS 5.4%