Fallos del tipo CWE-77
2808 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2022-43367CRITICALIP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.EPSS 5.2%CVE-2024-12358MEDIUMWeiYe-Jing datax-web add os command injectionEPSS 5.2%CVE-2026-7608MEDIUMTRENDnet TEW-821DAP tools_diagnostic os command injectionEPSS 5.2%CVE-2024-8214MEDIUMD-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R5_2nd_DiskMGR command injectionEPSS 5.2%CVE-2026-2260HIGHD-Link DCS-931L setSysAdmin os command injectionEPSS 5.2%CVE-2021-43113CRITICALiTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (EPSS 5.2%CVE-2025-15257MEDIUMEdimax BR-6208AC Web-based Configuration formRoute command injectionEPSS 5.1%CVE-2025-1947MEDIUMhzmanyun Education and Training System UploadImageController.java scorm command injectionEPSS 5.1%CVE-2025-1946MEDIUMhzmanyun Education and Training System exportPDF command injectionEPSS 5.1%CVE-2026-2082MEDIUMD-Link DIR-823X set_mac_clone os command injectionEPSS 5.1%CVE-2026-8767LOWvercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injectionEPSS 5.1%CVE-2026-5844HIGHD-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injectionEPSS 5.1%CVE-2025-9585MEDIUMComfast CF-N1 webmgnt wifilith_delete_pic_file command injectionEPSS 5.1%CVE-2025-9583MEDIUMComfast CF-N1 webmgnt ping_config command injectionEPSS 5.1%CVE-2025-12916MEDIUMSangfor Operation and Maintenance Security Management System Frontend portal_login command injectionEPSS 5.1%CVE-2026-10060MEDIUMTRENDnet TEW-432BRP formSetRoute command injectionEPSS 5.0%CVE-2026-10061MEDIUMTRENDnet TEW-432BRP formWPS command injectionEPSS 5.0%CVE-2026-30623CRITICALLiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to addEPSS 5.0%CVE-2025-7932MEDIUMD-Link DIR‑817L ssdpcgi lxmldbc_system command injectionEPSS 5.0%CVE-2026-7690MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_adm command injectionEPSS 5.0%