Fallos del tipo CWE-77
2808 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-33113MEDIUMD-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.EPSS 3.4%CVE-2026-4465MEDIUMD-Link DIR-513 formSysCmd os command injectionEPSS 3.4%CVE-2026-26068CRITICALemp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)EPSS 3.4%CVE-2025-14208MEDIUMD-Link DIR-823X set_wan_settings sub_415028 command injectionEPSS 3.4%CVE-2025-49835HIGHGHSL-2025-047: GPT-SoVITS Command Injection vulnerabilityEPSS 3.4%CVE-2026-2168MEDIUMD-Link DWR-M921 formLtefotaUpgradeQuectel sub_419920 command injectionEPSS 3.4%CVE-2026-4467MEDIUMComfast CF-AC100 mbox-config command injectionEPSS 3.4%CVE-2025-7415MEDIUMTenda O3V2 httpd getTraceroute fromTraceroutGet command injectionEPSS 3.4%CVE-2026-2178MEDIUMr-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injectionEPSS 3.4%CVE-2023-26822CRITICALD-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main.EPSS 3.4%CVE-2026-79697CRITICALAdvantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injectionEPSS 3.4%CVE-2024-48705MEDIUMWavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection whEPSS 3.4%CVE-2023-51664HIGHtj-actions/changed-files command injection in output filenamesEPSS 3.4%CVE-2025-1845MEDIUMESAFENET DSM examExportPDF command injectionEPSS 3.3%CVE-2025-4653HIGHRemote Code Execution leads to Command InjectionEPSS 3.3%CVE-2024-7215MEDIUMTOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injectionEPSS 3.3%CVE-2025-49833HIGHGHSL-2025-045: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2022-39073CRITICALThere is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the EPSS 3.3%CVE-2025-57199HIGHAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iEPSS 3.3%CVE-2026-7102MEDIUMTenda F456 httpd WriteFacMac FromWriteFacMac command injectionEPSS 3.3%