Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-57211HIGHTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_EPSS 1.2%CVE-2024-1356HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-25612HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-25611HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-25613HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 1.2%CVE-2024-12912HIGHAn improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution.
Refer to the '01/02/2EPSS 1.2%CVE-2021-41231HIGHOpenMage LTS DataFlow upload remote code execution vulnerabilityEPSS 1.2%CVE-2024-5914HIGHCortex XSOAR: Command Injection in CommonScripts PackEPSS 1.2%CVE-2024-10435MEDIUMdidi Super-Jacoco triggerEnvCov command injectionEPSS 1.2%CVE-2023-46485CRITICALAn issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of tEPSS 1.2%CVE-2026-11406MEDIUMGL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injectionEPSS 1.2%CVE-2023-46484CRITICALAn issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.EPSS 1.2%CVE-2024-40089CRITICALA Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code bEPSS 1.2%CVE-2023-23355MEDIUMQTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVREPSS 1.2%CVE-2025-23052HIGHAuthenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI InterfaceEPSS 1.2%CVE-2025-37133HIGHAuthenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage.EPSS 1.2%CVE-2026-16133LOWLiuMengxuan04 MiniCode mcp.ts child_process.spawn command injectionEPSS 1.2%CVE-2025-37134HIGHAuthenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceEPSS 1.2%CVE-2026-16763MEDIUMlocalstack serverless-localstack Configuration index.js os command injectionEPSS 1.2%CVE-2026-44872HIGHAuthenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management InterfaceEPSS 1.2%