Falhas do tipo CWE-77

2.807 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2024-4999CRITICALLigowave Unity/Pro/Mimo/APC Arbitrary Command InjectionEPSS 12.2%CVE-2025-1829MEDIUMTOTOLINK X18 cstecgi.cgi setMtknatCfg os command injectionEPSS 12.1%CVE-2025-14106HIGHZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injectionEPSS 12.1%CVE-2024-55544HIGHAuthenticated Command InjectionEPSS 12.0%CVE-2026-2615HIGHWavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injectionEPSS 12.0%CVE-2026-20841HIGHWindows Notepad App Remote Code Execution VulnerabilityEPSS 11.8%CVE-2026-3066MEDIUMHummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injectionEPSS 11.8%CVE-2025-10440MEDIUMD-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injectionEPSS 11.8%CVE-2025-10441MEDIUMD-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injectionEPSS 11.8%CVE-2018-14649CRITICALIt was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is donEPSS 11.7%CVE-2026-9441MEDIUMEdimax BR-6478AC POST Request formiNICbasic command injectionEPSS 11.7%CVE-2024-39360CRITICALAn os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craEPSS 11.7%CVE-2026-0732MEDIUMD-Link DI-8200G upgrade_filter.asp command injectionEPSS 11.7%CVE-2025-52690HIGHCommand Injection Vulnerability in the OmniAccess Stellar over UDP ServiceEPSS 11.6%CVE-2025-6299MEDIUMTOTOLINK N150RT formWSC os command injectionEPSS 11.6%CVE-2024-37642CRITICALTRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /foEPSS 11.4%CVE-2025-15137HIGHTRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934  command injectionEPSS 11.4%CVE-2020-8298—fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, anEPSS 11.2%CVE-2025-45488MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailexEPSS 11.1%CVE-2023-22884CRITICALApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowEPSS 11.1%