Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-90706 Command Injection in D-Link DWR-M921 (CVE-2026-90706)
CVE-2026-90705 Command Injection in D-Link DWR-M921 (CVE-2026-90705)
CVE-2026-90894 Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable...
CVE-2026-90702 Command Injection in D-Link DWR-M921 (CVE-2026-90702)
CVE-2026-90703 Command Injection in D-Link DWR-M921 (CVE-2026-90703)
CVE-2026-90699 Command Injection in D-Link DWR-M920 (CVE-2026-90699)
CVE-2026-90690 Command Injection in 0x4m4 HexStrike AI (CVE-2026-90690)
CVE-2026-82791 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue...
CVE-2026-82794 OS Command Injection in SolarView Compact (CVE-2026-82794)
CVE-2026-82779 OS Command Injection in CONPROSYS TM Series (CVE-2026-82779)
CVE-2026-82777 OS Command Injection in CONPROSYS PAC Series (CVE-2026-82777)
CVE-2026-82774 OS Command Injection in CONPROSYS M2M Gateway Series (CVE-2026-82774)
CVE-2026-82766 OS Command Injection in SGA1000 (CVE-2026-82766)
CVE-2026-82762 OS Command Injection in Contec FX5000 series (CVE-2026-82762)
CVE-2026-90621 Command Injection in ipa-lab HackingBuddyGPT (CVE-2026-90621)
CVE-2026-90617 Command Injection in GH05TCREW PentestAgent (CVE-2026-90617)
CVE-2026-90619 Command Injection in 0x4m4 HexStrike AI (CVE-2026-90619)
CVE-2026-90618 Command Injection in GH05TCREW PentestAgent (CVE-2026-90618)
CVE-2026-35867 OS Command Injection in LB-LINK router AC1900_AZ2 (CVE-2026-35867)
CVE-2026-90770 OS Command Injection in Spug (CVE-2026-90770)
CVE-2026-90492 Command Injection in webgjc web_robot (CVE-2026-90492)
CVE-2026-90444 A file-transfer interface that requires valid credentials accepts attacker-controlled filenames...
CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis component in projen before…
CVE-2026-7863 OS Command Injection in Pardus Software (CVE-2026-7863)
CVE-2026-8301 OS Command Injection in Pardus Boot Repair (CVE-2026-8301)
CVE-2026-89010 WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an...
CVE-2026-85979 Vulnerability in Affected (CVE-2026-85979)
CVE-2026-17176 OS Command Injection in Deco BE11000 (CVE-2026-17176)
CVE-2026-82095 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-82095)
CVE-2026-82098 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-82098)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details