Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2023-27848CRITICALbroccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.EPSS 1.9%CVE-2023-35932HIGHjcvi vulnerable to Configuration Injection due to unsanitized user input EPSS 1.9%CVE-2023-46421HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.EPSS 1.9%CVE-2023-46419HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.EPSS 1.9%CVE-2023-46422HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.EPSS 1.9%CVE-2023-46417HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.EPSS 1.9%CVE-2023-46416HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 funcEPSS 1.9%CVE-2023-46414HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 functionEPSS 1.9%CVE-2023-46424HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.EPSS 1.9%CVE-2023-46420HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.EPSS 1.9%CVE-2023-46423HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.EPSS 1.9%CVE-2023-46418HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.EPSS 1.9%CVE-2023-46415HIGHTOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.EPSS 1.9%CVE-2023-4310—BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability whicEPSS 1.8%CVE-2025-45489MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostnaEPSS 1.8%CVE-2022-40752CRITICALIBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-FEPSS 1.8%CVE-2025-50757MEDIUMWavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. ThisEPSS 1.8%CVE-2023-34233HIGHSnowflake Python Connector vulnerable to Command InjectionEPSS 1.8%CVE-2024-11634CRITICALCommand injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authentiEPSS 1.8%CVE-2021-3855HIGHCommand Injection in Liman Central Management SystemEPSS 1.8%