Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2023-22371HIGHAn os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafteEPSS 3.4%CVE-2026-6987MEDIUMPicoClaw Web Launcher Management Plane restart command injectionEPSS 3.4%CVE-2026-11339MEDIUMD-Link DWR-M920 formUSSDSetup sub_41CF20 command injectionEPSS 3.4%CVE-2025-5515MEDIUMTOTOLINK X2000R formMapDel command injectionEPSS 3.4%CVE-2026-2169MEDIUMD-Link DWR-M921 formLtefotaUpgradeFibocom command injectionEPSS 3.4%CVE-2026-1548MEDIUMTotolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injectionEPSS 3.4%CVE-2025-4653HIGHRemote Code Execution leads to Command InjectionEPSS 3.4%CVE-2022-39073CRITICALThere is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the EPSS 3.4%CVE-2024-33113MEDIUMD-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.EPSS 3.4%CVE-2025-1845MEDIUMESAFENET DSM examExportPDF command injectionEPSS 3.4%CVE-2026-9423MEDIUMEdimax BR-6675nD POST Request mp command injectionEPSS 3.4%CVE-2026-8346MEDIUMD-Link DIR-816 portForward command injectionEPSS 3.4%CVE-2025-9934MEDIUMTOTOLINK X5000R cstecgi.cgi sub_410C34 command injectionEPSS 3.4%CVE-2025-14208MEDIUMD-Link DIR-823X set_wan_settings sub_415028 command injectionEPSS 3.4%CVE-2026-90847CRITICALEFM ipTIME C200E System Setup iux_set.cgi os command injectionEPSS 3.4%CVE-2025-7415MEDIUMTenda O3V2 httpd getTraceroute fromTraceroutGet command injectionEPSS 3.4%CVE-2023-26822CRITICALD-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main.EPSS 3.4%CVE-2026-5153MEDIUMTenda CH22 WriteFacMac FormWriteFacMac command injectionEPSS 3.4%CVE-2024-48705MEDIUMWavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection whEPSS 3.4%CVE-2023-51664HIGHtj-actions/changed-files command injection in output filenamesEPSS 3.4%