Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-14522 OS Command Injection in IBM App Connect Enterprise (CVE-2026-14522)
CVE-2026-22622 Improper input validation in one of the session management interface of Eaton's Tripp Lite series...
CVE-2026-22621 Improper input validation in one of the session management interface of Eaton's Tripp Lite Series...
CVE-2026-44106 A privilege escalation vulnerability in the init-script for user-applications allows a low...
CVE-2026-44099 A privilege escalation vulnerability in the system configuration allows a low-privileged local...
CVE-2026-44098 OS Command Injection in Firewall Bypass (CVE-2026-44098)
CVE-2026-44095 A privilege escalation vulnerability in a script used for network configuration allows a low...
CVE-2026-44096 OS Command Injection in Linux (CVE-2026-44096)
CVE-2026-44093 A local privilege escalation vulnerability in the init-script for user-applications allows a low...
CVE-2026-16524 OS Command Injection in PCP's linux_sockets PMDA (CVE-2026-16524)
CVE-2026-67438 OS Command Injection in github.com/OliveTin/OliveTin (CVE-2026-67438)
CVE-2026-56389 OS Command Injection in Gnu Bison (CVE-2026-56389)
CVE-2026-14958 OS Command Injection in Ibm Aspera Faspex (CVE-2026-14958)
CVE-2026-14959 OS Command Injection in Ibm Aspera Faspex (CVE-2026-14959)
CVE-2026-61376 OS Command Injection in Restore Settings (CVE-2026-61376)
CVE-2026-59764 OS Command Injection in WebUI (CVE-2026-59764)
CVE-2026-24252 OS Command Injection in NVIDIA NeMo for Linux (CVE-2026-24252)
CVE-2026-16812 KEV [KEV] OS Command Injection in Arista VeloCloud Orchestrator (CVE-2026-16812)
CVE-2025-59172 OS Command Injection in Ericsson Packet Core Controller (CVE-2025-59172)
CVE-2026-59686 OS Command Injection in Progress Software LoadMaster (CVE-2026-59686)
CVE-2026-59687 OS Command Injection in Progress Software LoadMaster (CVE-2026-59687)
CVE-2026-59688 OS Command Injection in Progress Software LoadMaster (CVE-2026-59688)
CVE-2026-17497 OS Command Injection in NoteGen (CVE-2026-17497)
CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options…
CVE-2026-73414 OS Command Injection in shescape (CVE-2026-73414)
CVE-2026-73412 OS Command Injection in shescape (CVE-2026-73412)
CVE-2026-65711 sysPass through version 3.2.11 contains an OS command injection vulnerability that allows...
CVE-2026-66138 OS Command Injection in OpenStack Ironic Python Agent (CVE-2026-66138)
CVE-2026-63732 OS Command Injection in 9router (CVE-2026-63732)
CVE-2026-16763 Command Injection in localstack serverless-localstack (CVE-2026-16763)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details