Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2025-1338MEDIUMNUUO Camera handle_config.php print_file command injectionEPSS 51.1%CVE-2023-33919HIGHA vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05).EPSS 47.7%CVE-2025-47188MEDIUMA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference UnEPSS 47.5%CVE-2025-54782CRITICAL@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS DevelopersEPSS 47.2%CVE-2025-7083MEDIUMBelkin F9K1122 webs mp os command injectionEPSS 46.3%CVE-2025-32813HIGHAn issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.EPSS 45.0%CVE-2024-7029HIGHCommand Injection in AVTech AVM1203 (IP Camera)EPSS 43.3%CVE-2022-2234CRITICALmySCADA myPRO Command InjectionEPSS 43.2%CVE-2022-45701HIGHArris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.EPSS 42.6%CVE-2026-3943MEDIUMH3C ACG1000-AK230 aaa_portal_auth_local_submit command injectionEPSS 42.6%CVE-2026-3854HIGHRemote code execution via git push option injection in GitHub Enterprise ServerEPSS 41.9%CVE-2023-33538HIGHTP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the componentEPSS 41.6%KEVCVE-2020-23584CRITICALUnauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands witEPSS 41.4%CVE-2016-10329—Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code vEPSS 40.8%CVE-2010-5330CRITICALOn certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is notEPSS 40.2%KEVCVE-2020-10826CRITICAL/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injectiEPSS 39.4%CVE-2025-52688CRITICALCommand Injection Vulnerability in the OmniAccess Stellar Web Management InterfaceEPSS 37.1%CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2017-6327HIGHThe Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an indEPSS 35.9%KEVCVE-2025-5306HIGHCommand Injection in Netflow pathEPSS 35.7%