Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-15033MEDIUMchristopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injectionEPSS 1.8%CVE-2026-82597MEDIUMTOTOLINK NR1800X cstecgi.cgi setUssd command injectionEPSS 1.8%CVE-2026-4192MEDIUMAvinashBole quip-mcp-server index.ts setupToolHandlers command injectionEPSS 1.8%CVE-2026-6141MEDIUMdanielmiessler Personal_AI_Infrastructure parse_url.ts os command injectionEPSS 1.8%CVE-2026-15513MEDIUMWavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injectionEPSS 1.8%CVE-2026-75011MEDIUMkylecui NetForensicMCP index.js execAsync command injectionEPSS 1.8%CVE-2026-75985MEDIUMTRENDnet Router ping.cgi command injectionEPSS 1.8%CVE-2026-90621MEDIUMipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injectionEPSS 1.8%CVE-2026-91853MEDIUMTOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injectionEPSS 1.8%CVE-2025-58132MEDIUMZoom Clients for Windows - Command InjectionEPSS 1.8%CVE-2025-44877CRITICALTenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parametEPSS 1.8%CVE-2025-44872CRITICALTenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName paraEPSS 1.8%CVE-2020-3224HIGHCisco IOS XE Software Web UI Command Injection VulnerabilityEPSS 1.8%CVE-2025-14485LOWEFM ipTIME A3004T Administrator Password timepro.cgi show_debug_screen command injectionEPSS 1.8%CVE-2024-32281HIGHTenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter.EPSS 1.8%CVE-2023-1277HIGHkylin-system-updater Update InstallSnap command injectionEPSS 1.8%CVE-2023-1877MEDIUMCommand Injection in microweber/microweberEPSS 1.8%CVE-2023-24145CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUsEPSS 1.8%CVE-2023-24148CRITICALTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserDataEPSS 1.8%CVE-2024-55030CRITICALA command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands.EPSS 1.8%