Fallos del tipo CWE-77
2811 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-55182HIGHLibreNMS: Remote Code Execution by Signal Alert Transportation ModuleEPSS 1.6%CVE-2024-22122LOWAT(GSM) Command InjectionEPSS 1.6%CVE-2023-22789HIGHAuthenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line InterfaceEPSS 1.6%CVE-2022-22688HIGHImproper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology EPSS 1.6%CVE-2026-38834HIGHTenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameterEPSS 1.6%CVE-2024-22127CRITICALCode Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)EPSS 1.6%CVE-2023-36415HIGHAzure Identity SDK Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-38644HIGHNotes Station 3EPSS 1.6%CVE-2025-10619MEDIUMsequa-ai sequa-mcp OAuth Server Discovery node-oauth-client-provider.ts redirectToAuthorization os command injectionEPSS 1.6%CVE-2023-2910HIGHA Command injection vulnerability was found on Printer service of ADMEPSS 1.6%CVE-2023-25805CRITICALversionn Command Injection VulnerabilityEPSS 1.6%CVE-2026-11448MEDIUMGL.iNet GL-MT3000 Minidlna Service rpc realpath command injectionEPSS 1.6%CVE-2023-37469HIGHCasaOS Command Injection vulnerabilityEPSS 1.6%CVE-2026-47827HIGHCVE-2026-47827 – BOSH CLI Powershell InjectionEPSS 1.6%CVE-2019-5623—Accellion File Transfer Appliance Improper Neutralization of Special Elements used in a Command ('Command Injection')EPSS 1.6%CVE-2021-1554MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.6%CVE-2022-37883HIGHVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onEPSS 1.6%CVE-2022-37879HIGHVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onEPSS 1.6%CVE-2022-37881HIGHVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onEPSS 1.6%CVE-2021-1548MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.6%