Falhas do tipo CWE-78
4.589 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2020-15608CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15431CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15425CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15421CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15427CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15615CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15606CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15426CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15432CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15610CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15433CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15420CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. AuthenEPSS 8.1%CVE-2020-15613CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15423CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15424CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15430CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15609CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15428CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2026-58455CRITICALDockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.phpEPSS 8.0%CVE-2026-28287HIGHFreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsEPSS 8.0%