Falhas do tipo CWE-77

2.816 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2025-59741CRITICALMultiple vulnerabilities in AndSoft's e-TMSEPSS 1.3%CVE-2023-51707CRITICALMotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x aEPSS 1.3%CVE-2024-28135MEDIUMPHOENIX CONTACT: command injection vulnerability in the API of the CHARX SeriesEPSS 1.3%CVE-2023-48791HIGHAn improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, EPSS 1.3%CVE-2026-10127MEDIUMEdimax BR-6478AC POST Request formStaDrvSetup command injectionEPSS 1.3%CVE-2025-23196HIGHApache Ambari: Code Injection Vulnerability in Ambari Alert DefinitionEPSS 1.3%CVE-2024-37023CRITICALVonets WiFi Bridges Command InjectionEPSS 1.3%CVE-2023-24184CRITICALTOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.EPSS 1.3%CVE-2020-22662HIGHIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, RuckusEPSS 1.3%CVE-2026-42258MEDIUMnet-imap: Command Injection via unvalidated Symbol inputsEPSS 1.3%CVE-2024-11665HIGHUnauthenticated Remote Command InjectionEPSS 1.3%CVE-2026-67323HIGHGitPython before 3.1.51 Command Injection via unguarded Git optionsEPSS 1.3%CVE-2025-37092HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2025-37089HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2023-29855HIGHWBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.EPSS 1.2%CVE-2026-1735LOWYealink MeetingBar A30 Diagnostic command injectionEPSS 1.2%CVE-2025-37096HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2025-23094HIGHThe Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, EPSS 1.2%CVE-2025-46427HIGHDell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('CommaEPSS 1.2%CVE-2024-37091CRITICALWordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerabilityEPSS 1.2%