Fallos del tipo CWE-77
2811 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2021-1547MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.6%CVE-2023-27581HIGHgithub-slug-action vulnerable to arbitrary code executionEPSS 1.6%CVE-2026-93966MEDIUMaiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injectionEPSS 1.6%CVE-2026-11450MEDIUMGL.iNet GL-MT3000 Path Normalization dlopen command injectionEPSS 1.6%CVE-2025-3546HIGHH3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.6%CVE-2019-14944MEDIUMAn issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows iEPSS 1.6%CVE-2025-59470CRITICALThis vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or oEPSS 1.6%CVE-2022-42897CRITICALArray Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and contEPSS 1.6%CVE-2026-45663CRITICALDokploy: Remote Code Execution via destinationPath in Container File UploadEPSS 1.6%CVE-2023-35031HIGHAtos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 REPSS 1.6%CVE-2022-39243HIGHNuProcess vulnerable to command-line injection through insertion of NUL character(s)EPSS 1.6%CVE-2023-24540CRITICALImproper handling of JavaScript whitespace in html/templateEPSS 1.6%CVE-2024-33342HIGHD-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to eEPSS 1.6%CVE-2024-29385CRITICALDIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.EPSS 1.6%CVE-2026-42453HIGHTermix: Command injection in extractArchive/compressFiles via double-quote escaping bypassEPSS 1.6%CVE-2022-40100CRITICALTenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.EPSS 1.6%CVE-2021-28812HIGHCommand Injection Vulnerability in Video StationEPSS 1.6%CVE-2026-44854HIGHAuthenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management InterfaceEPSS 1.6%CVE-2026-44853HIGHAuthenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management InterfaceEPSS 1.6%CVE-2026-5433CRITICALImproper sanitizationEPSS 1.6%