Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2026-111853 OS Command Injection in FILESystem:MOUNT:DRIve SCPI command handler (CVE-2026-111853)
CVE-2026-108743 OS Command Injection in Apache (CVE-2026-108743)
CVE-2026-102608 OS Command Injection in ZoneMinder (CVE-2026-102608)
CVE-2026-30971 OS Command Injection in ZoneMinder (CVE-2026-30971)
CVE-2026-102607 OS Command Injection in ZoneMinder (CVE-2026-102607)
CVE-2026-96620 Vulnerability in claude-agent-sdk (CVE-2026-96620)
CVE-2026-92263 OS Command Injection in SparkyFitness (CVE-2026-92263)
CVE-2026-88755 OS Command Injection in Z.ai ZCode (CVE-2026-88755)
CVE-2026-111451 OS Command Injection in Wheels CLI (CVE-2026-111451)
CVE-2026-111229 pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in...
CVE-2026-111226 pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows...
CVE-2026-111218 OS Command Injection in Netgate pfSense CE (CVE-2026-111218)
CVE-2026-111224 OS Command Injection in OpenVPN openvpn.connect_async.sh script (CVE-2026-111224)
CVE-2026-111217 OS Command Injection in Netgate pfSense CE (CVE-2026-111217)
CVE-2026-111225 OS Command Injection in Netgate pfSense CE (CVE-2026-111225)
CVE-2026-111216 OS Command Injection in Netgate pfSense CE (CVE-2026-111216)
CVE-2026-111215 OS Command Injection in Netgate pfSense CE (CVE-2026-111215)
CVE-2026-111214 OS Command Injection in Netgate pfSense CE (CVE-2026-111214)
CVE-2026-103929 OS Command Injection in mise (CVE-2026-103929)
CVE-2026-45449 OS Command Injection in Unitronics UniStream Pro/UniLogic (CVE-2026-45449)
CVE-2026-110957 Command Injection in Wavlink WL-WN530BE2-A (CVE-2026-110957)
CVE-2026-55453 Vulnerability in OpenPrinting CUPS (CVE-2026-55453)
CVE-2026-57155 Path Traversal in OPNsense (CVE-2026-57155)
CVE-2026-47786 OS Command Injection in HybridDesk Station (CVE-2026-47786)
CVE-2026-34007 OS Command Injection in Notes Station (CVE-2026-34007)
CVE-2026-41545 Vulnerability in QuMagie (CVE-2026-41545)
CVE-2026-110925 OS Command Injection in OpenSSH (CVE-2026-110925)
CVE-2026-110908 OS Command Injection in Netgate pfSense FRR package (CVE-2026-110908)
CVE-2026-0320 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated...
CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details