Falhas do tipo CWE-77

2.808 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2025-7788MEDIUMXuxueli xxl-job SampleXxlJob.java commandJobHandler os command injectionEPSS 4.9%CVE-2018-3746—The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on thEPSS 4.9%CVE-2026-1414MEDIUMSangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injectionEPSS 4.9%CVE-2026-3704MEDIUMWavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injectionEPSS 4.9%CVE-2026-5351MEDIUMTrendnet TEW-657BRM setup.cgi add_wps_client os command injectionEPSS 4.9%CVE-2026-4558HIGHLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injectionEPSS 4.9%CVE-2025-4340MEDIUMD-Link DIR-890L/DIR-806A1 soap.cgi sub_175C8 command injectionEPSS 4.9%CVE-2025-7097CRITICALComodo Internet Security Premium Manifest File cis_update_x64.xml os command injectionEPSS 4.8%CVE-2024-39763CRITICALMultiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505EPSS 4.8%CVE-2025-50688MEDIUMA command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality.EPSS 4.8%CVE-2025-9727MEDIUMD-Link DIR-816L soap.cgi soapcgi_main os command injectionEPSS 4.8%CVE-2026-5338MEDIUMTenda G103 Setting system.lua action_set_system_settings command injectionEPSS 4.8%CVE-2022-4616HIGHThe webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerabiEPSS 4.8%CVE-2025-10123MEDIUMD-Link DIR-823X set_static_leases sub_415028 command injectionEPSS 4.7%CVE-2025-5126HIGHTeledyne FLIR AX8 settingsregional.php setDataTime command injectionEPSS 4.7%CVE-2026-15511CRITICALComfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injectionEPSS 4.7%CVE-2026-2152HIGHD-Link DIR-615 Web Configuration adv_routing.php os command injectionEPSS 4.7%CVE-2024-7616MEDIUMEdimax IC-6220DC/IC-5150W ipcam_cgi cgiFormString command injectionEPSS 4.7%CVE-2024-7833MEDIUMD-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injectionEPSS 4.7%CVE-2024-23749HIGHKiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitizatEPSS 4.7%