Falhas do tipo CWE-77

2.809 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2022-21668HIGHPipenv's requirements.txt parsing allows malicious index url in commentsEPSS 3.9%CVE-2024-45257HIGHA Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on thEPSS 3.9%CVE-2020-8171—We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AiEPSS 3.9%CVE-2023-31473MEDIUMAn issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on EPSS 3.9%CVE-2018-16461—A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the ranEPSS 3.9%CVE-2023-0611HIGHTRENDnet TEW-652BRP Web Management Interface get_set.ccp command injectionEPSS 3.9%CVE-2025-4350HIGHD-Link DIR-600L wake_on_lan command injectionEPSS 3.9%CVE-2025-4349HIGHD-Link DIR-600L formSysCmd command injectionEPSS 3.9%CVE-2026-4205MEDIUMD-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injectionEPSS 3.8%CVE-2026-4195MEDIUMD-Link DNS-1550-04 wizard_mgr.cgi command injectionEPSS 3.8%CVE-2023-23295HIGHKorenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an mEPSS 3.8%CVE-2025-60697HIGHA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. ThEPSS 3.8%CVE-2024-23346CRITICALpymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_stringEPSS 3.8%CVE-2026-3102MEDIUMexiftool PNG File MacOS.pm SetMacOSTags os command injectionEPSS 3.8%CVE-2025-15256MEDIUMEdimax BR-6208AC Web-based Configuration formStaDrvSetup command injectionEPSS 3.8%CVE-2025-7553MEDIUMD-Link DIR-818LW System Time Page os command injectionEPSS 3.8%CVE-2025-15254MEDIUMTenda W6-S ATE Service ate TendaAte os command injectionEPSS 3.8%CVE-2022-29184HIGHCommand Injection/Argument Injection in GoCDEPSS 3.8%CVE-2025-11141MEDIUMRuijie NBR2100G-E branch_passw.php listAction os command injectionEPSS 3.8%CVE-2025-10107MEDIUMTRENDnet TEW-831DR formSysCmd command injectionEPSS 3.8%