Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-19348CRITICALShenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injectionEPSS 3.6%CVE-2024-22061HIGHA Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to exEPSS 3.6%CVE-2025-11490MEDIUMwonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injectionEPSS 3.5%CVE-2024-23627CRITICALMotorola MR2600 SaveStaticRouteIPv4Params Command Injection VulnerabilityEPSS 3.5%CVE-2024-23626CRITICALMotorola MR2600 SaveSysLogParams Command Injection VulnerabilityEPSS 3.5%CVE-2025-11098MEDIUMD-Link DIR-823X set_wifi_blacklists command injectionEPSS 3.5%CVE-2025-11095MEDIUMD-Link DIR-823X delete_offline_device command injectionEPSS 3.5%CVE-2020-3211HIGHCisco IOS XE Software Web UI Command Injection VulnerabilityEPSS 3.5%CVE-2025-60673MEDIUMAn unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in EPSS 3.5%CVE-2026-79741MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 3.5%CVE-2025-11121MEDIUMTenda AC18 AdvSetLanip command injectionEPSS 3.5%CVE-2019-16005HIGHCisco Webex Video Mesh Node Command Injection VulnerabilityEPSS 3.5%CVE-2026-7692MEDIUMWavlink WL-WN570HA1 adm.cgi ping_ddns command injectionEPSS 3.5%CVE-2026-7691MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_cmd command injectionEPSS 3.5%CVE-2026-4591MEDIUMkalcaddle kodbox fileThumb Endpoint app.php checkBin os command injectionEPSS 3.5%CVE-2016-6558—The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injectionEPSS 3.5%CVE-2026-1326MEDIUMTotolink NR1800X POST Request cstecgi.cgi setWanCfg command injectionEPSS 3.5%CVE-2023-30400CRITICALAn issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration scriptEPSS 3.5%CVE-2026-8344MEDIUMD-Link DIR-816 formDMZ.cgi sub_445E7C command injectionEPSS 3.5%CVE-2026-8345MEDIUMD-Link DIR-816 singlePortForward sub_445E7C command injectionEPSS 3.5%