Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-71551 OS Command Injection in Super Productivity (CVE-2026-71551)
CVE-2026-68939 OS Command Injection in Pyenv provides simple Python (CVE-2026-68939)
CVE-2026-75094 Command Injection in COMFAST CF-N1-S (CVE-2026-75094)
CVE-2026-67965 OS Command Injection in Tneda W20E (CVE-2026-67965)
CVE-2026-71858 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled…
CVE-2026-71472 OS Command Injection in acm-search-v2-rhel9 (CVE-2026-71472)
CVE-2026-75056 OS Command Injection in JetBrains IntelliJ IDEA (CVE-2026-75056)
CVE-2026-68519 OS Command Injection in glances (CVE-2026-68519)
CVE-2026-62982 OS Command Injection in glances (CVE-2026-62982)
CVE-2026-68518 OS Command Injection in glances (CVE-2026-68518)
CVE-2026-56686 OS Command Injection in Dell ObjectScale (CVE-2026-56686)
CVE-2026-56685 OS Command Injection in Dell ObjectScale (CVE-2026-56685)
CVE-2026-59910 OS Command Injection in Dell ObjectScale (CVE-2026-59910)
CVE-2026-74997 OS Command Injection in Roundcube Webmail (CVE-2026-74997)
CVE-2026-71567 In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected…
CVE-2026-55158 OS Command Injection in wktk/conflibot (CVE-2026-55158)
CVE-2026-74801 OS Command Injection in SiYuan (CVE-2026-74801)
CVE-2026-19982 Command Injection in GL.iNet BE9300 and MT6000 (CVE-2026-19982)
CVE-2026-19983 Command Injection in GL.iNet A1300 (CVE-2026-19983)
CVE-2026-19981 Command Injection in GL.iNet A1300 (CVE-2026-19981)
CVE-2026-19978 Command Injection in jiantao88 android-mcp-server (CVE-2026-19978)
CVE-2026-55157 OS Command Injection in @ooples/token-optimizer-mcp (CVE-2026-55157)
CVE-2026-73680 OS Command Injection in Cockpit CMS (CVE-2026-73680)
CVE-2026-17186 OS Command Injection in IBM Db2 Mirror for i (CVE-2026-17186)
CVE-2026-17179 OS Command Injection in IBM Db2 Mirror for i (CVE-2026-17179)
CVE-2026-19682 OS Command Injection in Security Center (CVE-2026-19682)
CVE-2026-19679 OS Command Injection in Security Center's file upload handling (CVE-2026-19679)
CVE-2026-19681 OS Command Injection in Security Center related to file upload processing (CVE-2026-19681)
CVE-2026-19635 OS Command Injection in Security Center (CVE-2026-19635)
CVE-2026-19628 OS Command Injection in Tenable Security Center (CVE-2026-19628)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details