Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2026-87682 OS Command Injection in Broadcom Fabric Operating System (CVE-2026-87682)
CVE-2026-87680 OS Command Injection in Brocade Fabric OS (CVE-2026-87680)
CVE-2026-76437 OS Command Injection in Cisco License On-Prem (CVE-2026-76437)
CVE-2026-106556 OS Command Injection in Backstage (CVE-2026-106556)
CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...
CVE-2026-106059 OS Command Injection in GitAhead (CVE-2026-106059)
CVE-2026-106058 OS Command Injection in GitAhead (CVE-2026-106058)
CVE-2026-106057 OS Command Injection in patool (CVE-2026-106057)
CVE-2026-106056 OS Command Injection in Rundeck (CVE-2026-106056)
CVE-2026-92531 OS Command Injection in BugTracker.NET (CVE-2026-92531)
CVE-2026-102160 OS Command Injection in CloudVision CUE backup management (CVE-2026-102160)
CVE-2026-101207 Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0,...
CVE-2026-105797 OS Command Injection in SimpleChat (CVE-2026-105797)
CVE-2026-105793 OS Command Injection in Microsoft UFO (CVE-2026-105793)
CVE-2026-91140 An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in...
CVE-2026-85523 OS Command Injection in SambaBox (CVE-2026-85523)
CVE-2026-105841 OS Command Injection in lrzsz (CVE-2026-105841)
CVE-2026-105788 OS Command Injection in Microsoft UFO (CVE-2026-105788)
CVE-2026-105487 Command Injection in yogeshojha reNgine (CVE-2026-105487)
CVE-2026-105484 Command Injection in TOTOLINK X6000R (CVE-2026-105484)
CVE-2026-105740 OS Command Injection in Langflow (CVE-2026-105740)
CVE-2026-105697 OS Command Injection in langflow (CVE-2026-105697)
CVE-2026-105767 Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs...
CVE-2026-105691 OS Command Injection in Penpot (CVE-2026-105691)
CVE-2026-105134 KEV [KEV] Command Injection in Ahsay AhsayCBS (CVE-2026-105134)
CVE-2026-20305 OS Command Injection in Cisco ISE (CVE-2026-20305)
CVE-2026-20350 OS Command Injection in Cisco ThousandEyes Virtual Appliance (CVE-2026-20350)
CVE-2026-87911 OS Command Injection in Amazon (CVE-2026-87911)
CVE-2026-104019 OS Command Injection in Amazon SageMaker Distribution (CVE-2026-104019)
CVE-2026-75937 A specially crafted HTTP POST request to the web administration interface allows an...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details