Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-57227HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fuEPSS 1.2%CVE-2024-57226HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.EPSS 1.2%CVE-2024-57228HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.EPSS 1.2%CVE-2026-19039MEDIUMKino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injectionEPSS 1.2%CVE-2026-19978MEDIUMjiantao88 android-mcp-server Command Execution index.js child_process.exec os command injectionEPSS 1.2%CVE-2023-48702HIGHJellyfin Possible Remote Code Execution via custom FFmpeg binaryEPSS 1.2%CVE-2025-37091HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2026-12223MEDIUMYealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injectionEPSS 1.2%CVE-2024-43613HIGHAzure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2024-49042HIGHAzure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2025-59468CRITICALThis vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a
malicious passworEPSS 1.2%CVE-2023-40263HIGHAn issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp.EPSS 1.2%CVE-2025-29209CRITICALTOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of EPSS 1.2%CVE-2024-2947HIGHCockpit: command injection when deleting a sosreport with a crafted nameEPSS 1.2%CVE-2025-4850MEDIUMTOTOLINK N300RH cstecgi.cgi setUnloadUserData command injectionEPSS 1.2%CVE-2022-34660MEDIUMA vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), TeamcenteEPSS 1.2%CVE-2023-26128HIGHAll versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sanEPSS 1.2%CVE-2025-4729MEDIUMTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionEPSS 1.2%CVE-2024-12992HIGHRemote Code Execution leads to Command InjectionEPSS 1.2%CVE-2024-38486HIGHDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special ElemenEPSS 1.2%