Fallos del tipo CWE-77
2960 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-8129MEDIUMD-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injectionEPSS 23.8%CVE-2024-5195MEDIUMArris VAP2500 diag_s.php command injectionEPSS 23.6%CVE-2024-5196MEDIUMArris VAP2500 tools_command.php command injectionEPSS 23.6%CVE-2024-37186CRITICALAn os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cEPSS 23.4%CVE-2024-39914CRITICAL FOG has a command injection in /fog/management/export.php?filename=EPSS 23.2%CVE-2024-9793MEDIUMTenda AC1206 ate ate_ifconfig_set command injectionEPSS 23.1%CVE-2021-22899HIGHA command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote coEPSS 22.9%KEVCVE-2024-53945HIGHThe KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atEPSS 22.9%CVE-2023-44959HIGHAn issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP AdEPSS 22.8%CVE-2025-44084CRITICALD-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests,EPSS 22.6%CVE-2016-6367HIGHCisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain priEPSS 22.6%KEVCVE-2024-0919HIGHTRENDnet TEW-815DAP POST Request do_setNTP command injectionEPSS 22.5%CVE-2025-27423HIGHImproper Input Validation in VimEPSS 22.5%CVE-2025-15472HIGHTRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injectionEPSS 22.4%CVE-2023-45498CRITICALVinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.EPSS 22.0%CVE-2026-3064MEDIUMHummerRisk Cloud Task Scheduler ResourceCreateService.java command injectionEPSS 21.9%CVE-2024-53333MEDIUMTOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allEPSS 21.2%CVE-2023-0830MEDIUMEasyNAS backup.pl system os command injectionEPSS 20.9%CVE-2024-9076MEDIUMDedeCMS article_string_mix.php os command injectionEPSS 20.8%CVE-2024-6269MEDIUMRuijie RG-UAC HTTP POST Request sxh_vpnlic.php get_ip.addr_details command injectionEPSS 20.6%