Falhas do tipo CWE-77

2.817 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2026-30625CRITICALUpsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users toEPSS 1.2%CVE-2024-57226HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.EPSS 1.2%CVE-2024-57228HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.EPSS 1.2%CVE-2024-57227HIGHLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fuEPSS 1.2%CVE-2026-19978MEDIUMjiantao88 android-mcp-server Command Execution index.js child_process.exec os command injectionEPSS 1.2%CVE-2023-48702HIGHJellyfin Possible Remote Code Execution via custom FFmpeg binaryEPSS 1.2%CVE-2026-19039MEDIUMKino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injectionEPSS 1.2%CVE-2025-37091HIGHA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS 1.2%CVE-2026-12223MEDIUMYealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injectionEPSS 1.2%CVE-2024-43613HIGHAzure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2023-40263HIGHAn issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp.EPSS 1.2%CVE-2024-49042HIGHAzure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2025-59468CRITICALThis vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passworEPSS 1.2%CVE-2024-2947HIGHCockpit: command injection when deleting a sosreport with a crafted nameEPSS 1.2%CVE-2025-29209CRITICALTOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of EPSS 1.2%CVE-2025-4850MEDIUMTOTOLINK N300RH cstecgi.cgi setUnloadUserData command injectionEPSS 1.2%CVE-2022-34660MEDIUMA vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), TeamcenteEPSS 1.2%CVE-2023-26128HIGHAll versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sanEPSS 1.2%CVE-2025-4729MEDIUMTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionEPSS 1.2%CVE-2024-12992HIGHRemote Code Execution leads to Command InjectionEPSS 1.2%