Falhas do tipo CWE-77

2.811 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2024-54007HIGHAuthenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client BridgeEPSS 1.6%CVE-2024-54006HIGHAuthenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client BridgeEPSS 1.6%CVE-2022-25908HIGHAll versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-inputEPSS 1.5%CVE-2026-26015CRITICALUnauthenticated RCE in DocsGPT MCP STDIO ConfigurationEPSS 1.5%CVE-2020-8211—Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.EPSS 1.5%CVE-2024-22197HIGHAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)EPSS 1.5%CVE-2022-32665CRITICALIn Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no adEPSS 1.5%CVE-2023-36752CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36754CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36750CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36751CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-36753CRITICALA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 1.5%CVE-2023-28832HIGHA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versiEPSS 1.5%CVE-2026-0975HIGHDIAView - Command Injection VulnerabilityEPSS 1.5%CVE-2024-43028CRITICALA command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code EPSS 1.5%CVE-2025-37102HIGHAuthenticated Command Injection Vulnerability In Instant On Command Line InterfaceEPSS 1.5%CVE-2023-49040CRITICALAn issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_intEPSS 1.5%CVE-2024-39963HIGHAX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered EPSS 1.5%CVE-2023-28854HIGHnophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mailEPSS 1.5%CVE-2022-27806HIGHOn all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurEPSS 1.5%