Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-7215MEDIUMTOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injectionEPSS 3.3%CVE-2025-49835HIGHGHSL-2025-047: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2025-57199HIGHAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iEPSS 3.3%CVE-2026-7102MEDIUMTenda F456 httpd WriteFacMac FromWriteFacMac command injectionEPSS 3.3%CVE-2020-3219HIGHCisco IOS XE Software Web UI Command Injection VulnerabilityEPSS 3.3%CVE-2025-4032LOWinclusionAI AWorld shell_tool.py subprocess.Popen os command injectionEPSS 3.3%CVE-2025-53773HIGHGitHub Copilot and Visual Studio Remote Code Execution VulnerabilityEPSS 3.3%CVE-2026-3484MEDIUMPhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injectionEPSS 3.3%CVE-2024-21488HIGHVersions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function witEPSS 3.3%CVE-2025-49833HIGHGHSL-2025-045: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2025-57296MEDIUMTenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to thEPSS 3.3%CVE-2022-46421CRITICALApache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsEPSS 3.3%CVE-2024-35242HIGHComposer vulnerable to command injection via malicious git/hg branch namesEPSS 3.3%CVE-2025-10774MEDIUMRuijie 6000-E10 sub_commit.php os command injectionEPSS 3.3%CVE-2026-90699CRITICALD-Link DWR-M920 formPinManageSetup sub_41E60C os command injectionEPSS 3.3%CVE-2026-85223CRITICALD-Link DNS-340L CGI dropbox.cgi os command injectionEPSS 3.3%CVE-2026-82689CRITICALD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injectionEPSS 3.3%CVE-2026-82692CRITICALD-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injectionEPSS 3.3%CVE-2023-1458HIGHA vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknEPSS 3.3%CVE-2022-45796CRITICALSHARP Multifunction Printer - Command InjectionEPSS 3.3%