Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2020-15434CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.4%CVE-2024-7579MEDIUMAlien Technology ALR-F800 File Name upgrade.cgi popen os command injectionEPSS 8.4%CVE-2025-2611CRITICALICTBroadcast <= 7.4 Unauthenticated Session Cookie RCEEPSS 8.4%CVE-2026-2952MEDIUMVaelsys HTTP POST Request tree_server.php os command injectionEPSS 8.4%CVE-2020-15611CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.3%CVE-2024-33343HIGHD-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers EPSS 8.3%CVE-2025-54382CRITICALCherry Studio RCE Vulnerability DisclosureEPSS 8.3%CVE-2025-43979HIGHAn issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system coEPSS 8.3%CVE-2026-6992HIGHLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionEPSS 8.1%CVE-2026-76978HIGHCommand Injection vulnerabilityEPSS 8.1%CVE-2026-4253MEDIUMTenda AC8 Web UploadCfg route_set_user_policy_rule os command injectionEPSS 8.1%CVE-2020-15420CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. AuthenEPSS 8.1%CVE-2020-15609CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15425CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15615CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15421CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15432CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15606CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15610CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15614CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%