Fallos del tipo CWE-77
2808 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2023-0648MEDIUMdst-admin masterConsole command injectionEPSS 3.1%CVE-2024-2352MEDIUM1Panel swap baseApi.UpdateDeviceSwap command injectionEPSS 3.0%CVE-2020-2507CRITICALcommand injection vulnerability in HelpdeskEPSS 3.0%CVE-2024-52325MEDIUMECOVACS robot lawnmowers and vacuums command injectionEPSS 3.0%CVE-2026-4611HIGHTOTOLINK X6000R shttpd setLanCfg privilege escalationEPSS 3.0%CVE-2024-32026CRITICALKohya_ss is vulnerable to a command injection in `git_caption_gui.py` (`GHSL-2024-020`)EPSS 3.0%CVE-2024-32027CRITICALKohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`)EPSS 3.0%CVE-2023-24582HIGHTwo OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially cEPSS 3.0%CVE-2025-9935MEDIUMTOTOLINK N600R cstecgi.cgi sub_4159F8 command injectionEPSS 3.0%CVE-2018-0350—A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbiEPSS 3.0%CVE-2023-24583HIGHTwo OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially cEPSS 3.0%CVE-2026-6025CRITICALTotolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injectionEPSS 3.0%CVE-2024-7160MEDIUMTOTOLINK A3700R cstecgi.cgi setWanCfg command injectionEPSS 3.0%CVE-2022-44621CRITICALApache Kylin: Command injection by Diagnosis ControllerEPSS 3.0%CVE-2026-6028CRITICALTotolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injectionEPSS 3.0%CVE-2026-6029CRITICALTotolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injectionEPSS 3.0%CVE-2026-6026CRITICALTotolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injectionEPSS 3.0%CVE-2026-2169MEDIUMD-Link DWR-M921 formLtefotaUpgradeFibocom command injectionEPSS 3.0%CVE-2025-24150HIGHA privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 1EPSS 3.0%CVE-2025-53773HIGHGitHub Copilot and Visual Studio Remote Code Execution VulnerabilityEPSS 3.0%