Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-2560MEDIUMkalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injectionEPSS 2.5%CVE-2024-41316CRITICALTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancEPSS 2.5%CVE-2021-22864—Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerEPSS 2.5%CVE-2018-0454—Cisco Cloud Services Platform 2100 Command Injection VulnerabilityEPSS 2.5%CVE-2019-12629MEDIUMCisco SD-WAN vManage Command Injection VulnerabilityEPSS 2.5%CVE-2025-6621MEDIUMTOTOLINK CA300-PoE ap.so QuickSetting os command injectionEPSS 2.5%CVE-2025-6620MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionEPSS 2.5%CVE-2026-8217MEDIUMIndustrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injectionEPSS 2.4%CVE-2024-48904CRITICALAn command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.EPSS 2.4%CVE-2025-6619MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionEPSS 2.4%CVE-2025-6618MEDIUMTOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionEPSS 2.4%CVE-2024-31485HIGHA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1EPSS 2.4%CVE-2024-41318CRITICALTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_EPSS 2.4%CVE-2023-30135CRITICALTenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnloEPSS 2.4%CVE-2026-1623MEDIUMTotolink A7000R cstecgi.cgi setUpgradeFW command injectionEPSS 2.4%CVE-2025-1676MEDIUMhzmanyun Education and Training System pdf2swf os command injectionEPSS 2.4%CVE-2018-5403—Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basicEPSS 2.4%CVE-2026-90492MEDIUMwebgjc web_robot web.py controller_recover os command injectionEPSS 2.4%CVE-2023-49437CRITICALTenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlLisEPSS 2.4%CVE-2023-27837CRITICALTP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the functiEPSS 2.4%