Falhas do tipo CWE-77

2.810 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2026-6483HIGHWavlink WL-WN530H4 internet.cgi snprintf os command injectionEPSS 3.2%CVE-2026-75094CRITICALCOMFAST CF-N1-S CGI mbox-config sub_44B438 os command injectionEPSS 3.2%CVE-2026-19035HIGHShibby Tomato qoslimit new_qoslimit_start os command injectionEPSS 3.2%CVE-2026-92397CRITICALRuijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injectionEPSS 3.2%CVE-2023-31746CRITICALThere is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploitEPSS 3.2%CVE-2024-23628CRITICALMotorola MR2600 SaveStaticRouteIPv6Params Command Injection VulnerabilityEPSS 3.2%CVE-2025-6775MEDIUMxiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injectionEPSS 3.2%CVE-2023-0649MEDIUMdst-admin sendBroadcast command injectionEPSS 3.2%CVE-2023-0646MEDIUMdst-admin cavesConsole command injectionEPSS 3.2%CVE-2025-60701MEDIUMA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. ThEPSS 3.2%CVE-2025-60700MEDIUMA command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binarEPSS 3.2%CVE-2024-7214MEDIUMTOTOLINK LR350 cstecgi.cgi setWanCfg command injectionEPSS 3.2%CVE-2026-79698CRITICALAdvantech WISE-6610-NB Node-RED nodered_lib_apply command injectionEPSS 3.2%CVE-2023-34153HIGHA vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-fEPSS 3.1%CVE-2026-11339MEDIUMD-Link DWR-M920 formUSSDSetup sub_41CF20 command injectionEPSS 3.1%CVE-2024-20418CRITICALCisco Ultra-Reliable Wireless Backhaul Software Command Injection VulnerabilityEPSS 3.1%CVE-2023-0647MEDIUMdst-admin kickPlayer command injectionEPSS 3.1%CVE-2024-44402CRITICALD-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.EPSS 3.1%CVE-2024-32022CRITICALKohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)EPSS 3.1%CVE-2024-44413HIGHA vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp functEPSS 3.1%