Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-24321CRITICALAn issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_4EPSS 1.9%CVE-2026-50979HIGHA command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attaEPSS 1.9%CVE-2021-34809CRITICALImproper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology DEPSS 1.9%CVE-2026-16448MEDIUMD-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injectionEPSS 1.9%CVE-2026-90880MEDIUMD-Link DSL-3782 Diagnostics Diagnostics.asp system command injectionEPSS 1.9%CVE-2025-22912CRITICALRE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.EPSS 1.9%CVE-2026-93965MEDIUMaiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injectionEPSS 1.9%CVE-2025-22949CRITICALTenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execEPSS 1.9%CVE-2023-24161CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx fEPSS 1.9%CVE-2023-27232CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /settingEPSS 1.9%CVE-2023-24276CRITICALTOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delEPSS 1.9%CVE-2023-24238CRITICALTOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaEPSS 1.9%CVE-2023-24138CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost EPSS 1.9%CVE-2023-26848CRITICALTOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStatEPSS 1.9%CVE-2023-24159CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg funEPSS 1.9%CVE-2023-24236CRITICALTOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/deEPSS 1.9%CVE-2023-26978CRITICALTOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /settingEPSS 1.9%CVE-2023-24160CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg funEPSS 1.9%CVE-2023-24146CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg fuEPSS 1.9%CVE-2024-40110CRITICALSourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimagEPSS 1.9%