Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-9361MEDIUMEdimax EW-7438RPn POST Request formAccep formAccept command injectionEPSS 2.0%CVE-2026-19962MEDIUMEdimax EW-7478APC setWAN command injectionEPSS 2.0%CVE-2026-15496MEDIUMSonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injectionEPSS 2.0%CVE-2026-9362MEDIUMEdimax EW-7438RPn Setting formConnectionSetting command injectionEPSS 2.0%CVE-2026-19963MEDIUMEdimax EW-7478APC stainfo command injectionEPSS 2.0%CVE-2026-9437MEDIUMDTStack Taier REST API Runtime.exec os command injectionEPSS 2.0%CVE-2026-9439MEDIUMEdimax BR-6675nD stainfo command injectionEPSS 2.0%CVE-2026-9400MEDIUMEdimax BR-6675nD POST Request formUSBStorage command injectionEPSS 2.0%CVE-2026-13561MEDIUMEdimax EW-7478APC POST Request formiNICbasic os command injectionEPSS 2.0%CVE-2026-9441MEDIUMEdimax BR-6478AC POST Request formiNICbasic command injectionEPSS 2.0%CVE-2026-9378MEDIUMEdimax BR-6675nD POST Request formHwSet command injectionEPSS 2.0%CVE-2026-9359MEDIUMEdimax EW-7438RPn POST Request formHwSet command injectionEPSS 2.0%CVE-2026-12815MEDIUMcoollabsio coolify Image Name os command injectionEPSS 2.0%CVE-2026-9297MEDIUMEdimax BR-6428NS POST Request formWlbasic command injectionEPSS 2.0%CVE-2026-12810MEDIUMEdimax BR-6478AC V2 POST Request mp command injectionEPSS 2.0%CVE-2026-9363MEDIUMEdimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injectionEPSS 2.0%CVE-2025-4135MEDIUMNetgear WG302v2 ui_get_input_value command injectionEPSS 2.0%CVE-2023-0127HIGHA command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacEPSS 2.0%CVE-2024-1540HIGHCommand Injection in gradio-app/gradio via deploy+test-visual.yml workflowEPSS 2.0%CVE-2024-36604CRITICALTenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerabilitEPSS 2.0%