Fallos del tipo CWE-77
2809 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2023-24150CRITICALA command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to executEPSS 2.1%CVE-2023-35390HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 2.1%CVE-2023-24135HIGHJensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacMEPSS 2.1%CVE-2025-43844HIGHGHSL-2025-014_Retrieval-based-Voice-Conversion-WebUIEPSS 2.1%CVE-2025-43842HIGHGHSL-2025-012_Retrieval-based-Voice-Conversion-WebUIEPSS 2.1%CVE-2025-5106MEDIUMFujian Kelixun Filename fax_view.php os command injectionEPSS 2.1%CVE-2025-6103HIGHWifi-soft UniBox Controller test_accesscodelogin.php os command injectionEPSS 2.1%CVE-2018-19950—If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP SystEPSS 2.1%CVE-2026-7590MEDIUMeyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injectionEPSS 2.1%CVE-2026-7211MEDIUMdvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injectionEPSS 2.1%CVE-2026-7064MEDIUMAgentDeskAI browser-tools-mcp browser-connector.ts os command injectionEPSS 2.1%CVE-2026-5690MEDIUMTotolink A7100RU cstecgi.cgi setRemoteCfg os command injectionEPSS 2.1%CVE-2026-9452MEDIUMFoundDream miniclawd exec.ts ExecTool.execute os command injectionEPSS 2.1%CVE-2026-7785MEDIUMA-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injectionEPSS 2.1%CVE-2026-7215MEDIUMegtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injectionEPSS 2.1%CVE-2026-90619MEDIUM0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injectionEPSS 2.1%CVE-2026-5689MEDIUMTotolink A7100RU cstecgi.cgi setNtpCfg os command injectionEPSS 2.1%CVE-2026-5691MEDIUMTotolink A7100RU cstecgi.cgi setFirewallType os command injectionEPSS 2.1%CVE-2026-6158MEDIUMTotolink N300RH upgrade.so setUpgradeUboot os command injectionEPSS 2.1%CVE-2026-5677MEDIUMTotolink A7100RU cstecgi.cgi CsteSystem os command injectionEPSS 2.1%