Fallos del tipo CWE-77
2811 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-54007HIGHAuthenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client BridgeEPSS 1.6%CVE-2024-54006HIGHAuthenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client BridgeEPSS 1.6%CVE-2022-25908HIGHAll versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-inputEPSS 1.5%CVE-2026-26015CRITICALUnauthenticated RCE in DocsGPT MCP STDIO ConfigurationEPSS 1.5%CVE-2020-8211—Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.EPSS 1.5%CVE-2024-22197HIGHAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)EPSS 1.5%CVE-2022-32665CRITICALIn Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no adEPSS 1.5%CVE-2023-36752CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36754CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36750CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36751CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36753CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-28832HIGHA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versiEPSS 1.5%CVE-2026-0975HIGHDIAView - Command Injection VulnerabilityEPSS 1.5%CVE-2024-43028CRITICALA command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code EPSS 1.5%CVE-2025-37102HIGHAuthenticated Command Injection Vulnerability In Instant On Command Line InterfaceEPSS 1.5%CVE-2023-49040CRITICALAn issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_intEPSS 1.5%CVE-2024-39963HIGHAX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered EPSS 1.5%CVE-2023-28854HIGHnophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mailEPSS 1.5%CVE-2022-27806HIGHOn all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurEPSS 1.5%