Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2026-27558 OS Command Injection in /index.php (CVE-2026-27558)
CVE-2026-27551 OS Command Injection in /index.php (CVE-2026-27551)
CVE-2026-27550 A low-privileged remote attacker can exploit a command injection vulnerability in the...
CVE-2026-27549 OS Command Injection in /index.php (CVE-2026-27549)
CVE-2026-27548 OS Command Injection in /index.php (CVE-2026-27548)
CVE-2026-27547 OS Command Injection in /index.php (CVE-2026-27547)
CVE-2026-73447 A privileged attacker can exploit certain operation to execute arbitrary commands with root...
CVE-2026-86108 Insufficient validation of inputs supplied through affected VeloCloud Edge management and...
CVE-2026-10144 OS Command Injection in Rsbuild (CVE-2026-10144)
CVE-2026-76690 OS Command Injection in HPE Networking EdgeConnect SD-WAN Gateways (CVE-2026-76690)
CVE-2026-58502 githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow…
CVE-2026-52484 OS Command Injection in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 (CVE-2026-52484)
CVE-2026-91853 Command Injection in TOTOLINK X5000R (CVE-2026-91853)
CVE-2026-91936 OS Command Injection in Flowise (CVE-2026-91936)
CVE-2026-91931 OS Command Injection in Flowise (CVE-2026-91931)
CVE-2026-85013 OS Command Injection in environment-modules (CVE-2026-85013)
CVE-2026-57586 OS Command Injection in CodeRAG (CVE-2026-57586)
CVE-2026-89308 An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing...
CVE-2026-19515 The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied...
CVE-2026-77853 OS Command Injection in FF-RFI079I4 (CVE-2026-77853)
CVE-2026-90847 Command Injection in EFM ipTIME C200E (CVE-2026-90847)
CVE-2026-90843 Command Injection in SabyasachiRana WebMap (CVE-2026-90843)
CVE-2026-14277 OS Command Injection in IBM i Access Family (CVE-2026-14277)
CVE-2026-14275 OS Command Injection in IBM i Access Family (CVE-2026-14275)
CVE-2026-14276 OS Command Injection in IBM i Access Family (CVE-2026-14276)
CVE-2026-17133 OS Command Injection in IBM App Connect Enterprise (CVE-2026-17133)
CVE-2026-16673 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-16673)
CVE-2026-16466 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-16466)
CVE-2026-59960 OS Command Injection in @argos-ci/core (CVE-2026-59960)
CVE-2026-90788 Command Injection in magicblack MacCMS10 (CVE-2026-90788)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details