Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-57223CRITICALLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode fEPSS 1.7%CVE-2023-6572CRITICALCommand Injection in gradio-app/gradioEPSS 1.7%CVE-2025-45490MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the passwoEPSS 1.7%CVE-2024-48441HIGHWuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injectionEPSS 1.7%CVE-2023-52027CRITICALTOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost funcEPSS 1.7%CVE-2026-95660MEDIUMMoonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injectionEPSS 1.7%CVE-2023-0789HIGHCommand Injection in thorsten/phpmyfaqEPSS 1.7%CVE-2021-1552MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1549MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1553MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1550MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1551MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1555MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-44051HIGHCommand injectionEPSS 1.7%CVE-2022-31702CRITICALvRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network acceEPSS 1.7%CVE-2023-39293CRITICALA Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a maliciouEPSS 1.7%CVE-2023-31460HIGHA vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated aEPSS 1.7%CVE-2025-29517MEDIUMD-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 fuEPSS 1.6%CVE-2025-45984CRITICALBlink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8EPSS 1.6%CVE-2025-45986CRITICALBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450EPSS 1.6%