Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2020-15428CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15432CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15610CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15423CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15606CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15433CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15420CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. AuthenEPSS 8.1%CVE-2020-15425CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15613CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15426CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2020-15609CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. AuthenEPSS 8.1%CVE-2025-63932HIGHD-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service pEPSS 8.1%CVE-2026-8230MEDIUMWavlink NU516U1 login.cgi sys_login1 os command injectionEPSS 8.1%CVE-2026-8229MEDIUMWavlink NU516U1 wireless.cgi WifiBasic os command injectionEPSS 8.1%CVE-2026-8227MEDIUMWavlink NU516U1 adm.cgi wzdapMesh os command injectionEPSS 8.1%CVE-2026-58455CRITICALDockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.phpEPSS 8.0%CVE-2026-8192MEDIUMWavlink NU516U1 adm.cgi wzdap os command injectionEPSS 7.9%CVE-2023-26213HIGHOn Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exisEPSS 7.9%CVE-2024-5340MEDIUMRuijie RG-UAC sub_commit.php os command injectionEPSS 7.9%CVE-2024-5339MEDIUMRuijie RG-UAC online_check.php os command injectionEPSS 7.9%