Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2025-59738CRITICALMultiple vulnerabilities in AndSoft's e-TMSEPSS 1.4%CVE-2025-59739CRITICALMultiple vulnerabilities in AndSoft's e-TMSEPSS 1.4%CVE-2022-40021CRITICALQVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.EPSS 1.4%CVE-2024-44381HIGHD-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function.EPSS 1.4%CVE-2024-57539HIGHLinksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail.EPSS 1.4%CVE-2023-49959CRITICALIn Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote EPSS 1.4%CVE-2026-10273MEDIUMphp-censor Webhook Endpoint GitBuild.php os command injectionEPSS 1.4%CVE-2025-29522MEDIUMD-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping function.EPSS 1.4%CVE-2022-27588CRITICALVulnerability in QVREPSS 1.4%CVE-2023-0636HIGHRemote Code Execution via Command InjectionEPSS 1.4%CVE-2024-20667HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-39570HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to commaEPSS 1.4%CVE-2026-93371MEDIUMmarcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injectionEPSS 1.4%CVE-2023-23952CRITICALAdvanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability.EPSS 1.4%CVE-2024-39563MEDIUMJunos Space: Remote Command Execution (RCE) vulnerability in web applicationEPSS 1.3%CVE-2019-11278HIGHPrivilege Escalation via Blind SCIM Injection in UAAEPSS 1.3%CVE-2020-8188—We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine PEPSS 1.3%CVE-2025-55227HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-31729CRITICALTOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.EPSS 1.3%CVE-2026-10214MEDIUMzhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injectionEPSS 1.3%