Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2025-11523MEDIUMTenda AC7 AdvSetLanip command injectionEPSS 3.7%CVE-2026-26068CRITICALemp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)EPSS 3.7%CVE-2024-12350MEDIUMJFinalCMS Template TemplateController.java update command injectionEPSS 3.7%CVE-2026-86299CRITICALLinksys RE7000 PingTest json.cgi platform_event_pingTest os command injectionEPSS 3.7%CVE-2026-4499MEDIUMD-Link DIR-820LW SSDP ssdpcgi_main os command injectionEPSS 3.7%CVE-2023-22659HIGHAn os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafEPSS 3.7%CVE-2025-15254MEDIUMTenda W6-S ATE Service ate TendaAte os command injectionEPSS 3.7%CVE-2023-30623HIGHArbitrary command injection in embano1/wip EPSS 3.7%CVE-2022-32765CRITICALAn OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specialEPSS 3.7%CVE-2026-19771HIGHBaicells EG3661M LuCI Web luci os command injectionEPSS 3.7%CVE-2020-10518—Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerEPSS 3.7%CVE-2022-43109CRITICALD-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerabiliEPSS 3.7%CVE-2022-29184HIGHCommand Injection/Argument Injection in GoCDEPSS 3.6%CVE-2025-60672MEDIUMAn unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in EPSS 3.6%CVE-2026-18615CRITICALGL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injectionEPSS 3.6%CVE-2026-18601CRITICALGL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injectionEPSS 3.6%CVE-2026-18616CRITICALGL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injectionEPSS 3.6%CVE-2026-18684CRITICALGL.iNet GL-MT3000 modem.so glc remove_profile command injectionEPSS 3.6%CVE-2026-18602CRITICALGL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injectionEPSS 3.6%CVE-2026-18685CRITICALGL.iNet GL-MT3000 modem.so glc set_upgrade command injectionEPSS 3.6%