Fallos del tipo CWE-77
2807 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2021-42132—A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform EPSS 70.1%CVE-2023-26801CRITICALLB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a comEPSS 69.7%CVE-2017-15889—Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to exEPSS 68.3%CVE-2024-3116HIGHRemote Code Execution Vulnerability through the validate binary path API in pgAdmin 4EPSS 65.6%CVE-2016-20017CRITICALD-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wilEPSS 65.2%KEVCVE-2024-4883CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 64.5%CVE-2024-9380HIGHAn OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker witEPSS 63.2%KEVCVE-2023-4120MEDIUMByzoro Smart S85F Management Platform importhtml.php command injectionEPSS 62.3%CVE-2024-12971HIGHQuickShell Authenticated Command InjectionEPSS 61.5%CVE-2023-31446CRITICALIn Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. TEPSS 61.1%CVE-2022-2143CRITICALAdvantech iViewEPSS 59.4%CVE-2025-4443MEDIUMD-Link DIR-605L sub_454F2C command injectionEPSS 57.6%CVE-2023-28425MEDIUMSpecially crafted MSETNX command can lead to denial-of-serviceEPSS 54.7%CVE-2025-9528MEDIUMLinksys E1700 systemCommand os command injectionEPSS 54.5%CVE-2019-16012MEDIUMCisco SD-WAN Solution vManage SQL Injection VulnerabilityEPSS 54.2%CVE-2023-20118MEDIUMA vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers EPSS 54.1%KEVCVE-2020-25079HIGHAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticaEPSS 54.0%KEVCVE-2019-0541HIGHA remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code ExEPSS 53.2%KEVCVE-2025-54782CRITICAL@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS DevelopersEPSS 51.3%CVE-2025-1338MEDIUMNUUO Camera handle_config.php print_file command injectionEPSS 51.1%