Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,037

Image ID Title
CVE-2026-27955 OS Command Injection in Coolify (CVE-2026-27955)
CVE-2026-27957 OS Command Injection in Coolify (CVE-2026-27957)
CVE-2026-56808 DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability...
CVE-2026-56137 RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection...
CVE-2026-34594 OS Command Injection in Coolify (CVE-2026-34594)
CVE-2026-34597 OS Command Injection in Coolify (CVE-2026-34597)
CVE-2026-57999 luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login...
CVE-2026-58000 OS Command Injection in luci-proto-openvpn (CVE-2026-58000)
CVE-2026-13581 Command Injection in Edimax EW-7478APC (CVE-2026-13581)
CVE-2026-55607 Path Traversal in @anthropic-ai/claude-code (CVE-2026-55607)
CVE-2026-13560 Command Injection in Edimax EW-7478APC (CVE-2026-13560)
CVE-2026-13561 Command Injection in Edimax EW-7478APC (CVE-2026-13561)
CVE-2026-13545 Command Injection in D-Link DCS-935L (CVE-2026-13545)
CVE-2026-55697 OS Command Injection in pnpm (CVE-2026-55697)
CVE-2026-49869 KEV [KEV] OS Command Injection in Kestra OSS (CVE-2026-49869)
CVE-2026-32833 OS Command Injection in Cudy LT300 (CVE-2026-32833)
CVE-2026-48778 OS Command Injection in Notepad (CVE-2026-48778)
CVE-2026-48800 OS Command Injection in Notepad (CVE-2026-48800)
CVE-2026-54636 OS Command Injection in Dokku (CVE-2026-54636)
CVE-2026-45408 OS Command Injection in Dokku (CVE-2026-45408)
CVE-2026-40711 OS Command Injection in Dell Dell Container Storage Modules (CVE-2026-40711)
CVE-2026-55975 OS Command Injection in H.View IP cameras (CVE-2026-55975)
CVE-2025-71336 OS Command Injection in flowise (CVE-2025-71336)
CVE-2026-54088 Vulnerability in github.com/filebrowser/filebrowser/v2 (CVE-2026-54088)
CVE-2026-9717 OS Command Injection in Schneider Electric Powerlogic P7 Firmware (CVE-2026-9717)
CVE-2026-55895 OS Command Injection in Vim (CVE-2026-55895)
CVE-2026-46735 OS Command Injection in Dell Display (CVE-2026-46735)
CVE-2026-8664 OS Command Injection in Linux (CVE-2026-8664)
CVE-2026-8665 OS Command Injection in Linux (CVE-2026-8665)
CVE-2026-8660 OS Command Injection in Linux (CVE-2026-8660)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details