Fallos del tipo CWE-77
2811 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-55414CRITICALA vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physEPSS 1.1%CVE-2025-52904HIGHFile Browser: Command Execution not Limited to ScopeEPSS 1.1%CVE-2024-57590CRITICALTRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attEPSS 1.1%CVE-2025-61141HIGHsqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environmeEPSS 1.1%CVE-2024-24377HIGHAn issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted scriptEPSS 1.1%CVE-2026-11408MEDIUMvertex-app vertex Log Viewer Endpoint LogMod.js os command injectionEPSS 1.1%CVE-2025-44835MEDIUMD-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbitEPSS 1.1%CVE-2023-47562HIGHPhoto StationEPSS 1.1%CVE-2024-34792CRITICALWordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerabilityEPSS 1.1%CVE-2024-39028CRITICALAn issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.EPSS 1.1%CVE-2022-48255CRITICALThere is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerabilityEPSS 1.1%CVE-2024-55062CRITICALCode Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitraryEPSS 1.1%CVE-2025-65293MEDIUMCommand injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges throuEPSS 1.1%CVE-2023-24467HIGHPossible Command Injection in OpenText iManagerEPSS 1.1%CVE-2025-55893MEDIUMTOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.EPSS 1.1%CVE-2025-55901MEDIUMTOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter.EPSS 1.1%CVE-2017-12329—A vulnerability in the CLI of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an authenticated, locEPSS 1.1%CVE-2017-12330—A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attackEPSS 1.1%CVE-2022-25916HIGHVersions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scaEPSS 1.1%CVE-2026-11449MEDIUMGL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injectionEPSS 1.1%