Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2025-25743HIGHD-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.EPSS 1.7%CVE-2020-2492HIGHIf exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP SysteEPSS 1.7%CVE-2025-55637MEDIUMReolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vuEPSS 1.7%CVE-2025-5952MEDIUMZend.To NSSDropoff.php exec os command injectionEPSS 1.7%CVE-2024-3871CRITICALAuthenticated Remote Command Injection in Delta Electronics DVWEPSS 1.7%CVE-2023-26295CRITICALPrevious versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.EPSS 1.7%CVE-2026-94099CRITICALNetcore NBR200V2 Backup Restore restore.cgi command injectionEPSS 1.7%CVE-2022-20799MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilitiesEPSS 1.7%CVE-2025-7883HIGHEluktronics Control Center Powershell Script Command command injectionEPSS 1.7%CVE-2026-11452MEDIUMGL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injectionEPSS 1.7%CVE-2023-33136HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2021-31574CRITICALIn Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeEPSS 1.7%CVE-2026-53932HIGHwnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')EPSS 1.7%CVE-2021-31573CRITICALIn Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeEPSS 1.7%CVE-2025-57293HIGHA command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function iEPSS 1.7%CVE-2024-48440HIGHShenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command EPSS 1.7%CVE-2021-31575CRITICALIn Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeEPSS 1.7%CVE-2025-25632CRITICALTenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.EPSS 1.7%CVE-2024-57224CRITICALLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fuEPSS 1.7%CVE-2024-57225CRITICALLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.EPSS 1.7%