Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-20206 OS Command Injection in Cisco ThousandEyes Enterprise Agent (CVE-2026-20206)
CVE-2026-46420 OS Command Injection in shivammathur/setup-php (CVE-2026-46420)
CVE-2026-34234 OS Command Injection in CtrlPanel (CVE-2026-34234)
CVE-2026-46339 OS Command Injection in 9router (CVE-2026-46339)
CVE-2026-45695 OS Command Injection in github.com/kopia/kopia (CVE-2026-45695)
CVE-2026-8603 OS Command Injection in Scadabr (CVE-2026-8603)
CVE-2026-36828 OS Command Injection in Panabit PAP-XM320 (CVE-2026-36828)
CVE-2026-36827 OS Command Injection in Panabit PAP-XM320 (CVE-2026-36827)
CVE-2026-37281 An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin...
CVE-2026-27130 OS Command Injection in Dokploy (CVE-2026-27130)
CVE-2026-45626 OS Command Injection in github.com/getarcaneapp/arcane/backend (CVE-2026-45626)
CVE-2026-8767 Command Injection in vercel ai (CVE-2026-8767)
CVE-2026-45578 OS Command Injection in WWBN/AVideo (CVE-2026-45578)
CVE-2026-45035 OS Command Injection in Tabby (CVE-2026-45035)
CVE-2026-45036 OS Command Injection in Tabby (CVE-2026-45036)
CVE-2026-46483 OS Command Injection in Vim (CVE-2026-46483)
CVE-2026-41553 OS Command Injection in Dhtmlx (CVE-2026-41553)
CVE-2026-8654 Improper input validation in Delphix Continuous Data connectors allows an authenticated user to...
CVE-2026-44666 OS Command Injection in HRConvert2 (CVE-2026-44666)
CVE-2026-45369 OS Command Injection in utcp-cli (CVE-2026-45369)
CVE-2026-41315 OS Command Injection in mdserver-web (CVE-2026-41315)
CVE-2026-42589 OS Command Injection in github.com/gotenberg/gotenberg/v8 (CVE-2026-42589)
CVE-2026-42853 OS Command Injection in @apostrophecms/cli (CVE-2026-42853)
CVE-2026-26191 OS Command Injection in github.com/fleetdm/fleet/v4 (CVE-2026-26191)
CVE-2026-8500 Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI...
CVE-2026-44194 OS Command Injection in OPNsense (CVE-2026-44194)
CVE-2026-0261 OS Command Injection in Siemens Pan Os (CVE-2026-0261)
CVE-2026-6281 A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could...
CVE-2026-42924 OS Command Injection in Big Ip Access Policy Manager (CVE-2026-42924)
CVE-2026-34176 OS Command Injection in Big Ip Access Policy Manager (CVE-2026-34176)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details