Fallos del tipo CWE-77
2808 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2023-34153HIGHA vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-fEPSS 3.1%CVE-2026-11339MEDIUMD-Link DWR-M920 formUSSDSetup sub_41CF20 command injectionEPSS 3.1%CVE-2024-20418CRITICALCisco Ultra-Reliable Wireless Backhaul Software Command Injection VulnerabilityEPSS 3.1%CVE-2023-0647MEDIUMdst-admin kickPlayer command injectionEPSS 3.1%CVE-2024-44402CRITICALD-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.EPSS 3.1%CVE-2024-32022CRITICALKohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)EPSS 3.1%CVE-2024-44413HIGHA vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp functEPSS 3.1%CVE-2020-10519—Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerEPSS 3.1%CVE-2023-33533HIGHNetgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with FirEPSS 3.1%CVE-2026-8346MEDIUMD-Link DIR-816 portForward command injectionEPSS 3.1%CVE-2026-1413MEDIUMSangfor Operation and Maintenance Security Management System HTTP POST Request port_validate portValidate command injectionEPSS 3.1%CVE-2024-7158MEDIUMTOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injectionEPSS 3.1%CVE-2024-7181MEDIUMTOTOLINK A3600R cstecgi.cgi setTelnetCfg command injectionEPSS 3.1%CVE-2026-1149MEDIUMTotolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injectionEPSS 3.1%CVE-2024-46256CRITICALA Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt CertiEPSS 3.1%CVE-2022-46642CRITICALD-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgEPSS 3.1%CVE-2021-27449CRITICALMesa Labs AmegaView Command InjectionEPSS 3.1%CVE-2022-46641CRITICALD-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIEPSS 3.1%CVE-2024-21322HIGHMicrosoft Defender for IoT Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-31569CRITICALTOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.EPSS 3.1%