Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2025-34311 OS Command Injection in IPFire (CVE-2025-34311)
CVE-2025-34312 OS Command Injection in IPFire (CVE-2025-34312)
CVE-2025-1036 Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated…
CVE-2025-1038 The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input…
CVE-2025-12296 Command Injection in D-Link DAP-2695 (CVE-2025-12296)
CVE-2025-6978 OS Command Injection in Diagnostics (CVE-2025-6978)
CVE-2024-58274 Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a…
CVE-2025-47900 OS Command Injection in Time Provider (CVE-2025-47900)
CVE-2025-47901 OS Command Injection in Time Provider (CVE-2025-47901)
CVE-2025-34513 OS Command Injection in Ilevia EVE X1 Server firmware (CVE-2025-34513)
CVE-2025-34514 OS Command Injection in Ilevia EVE X1 Server firmware (CVE-2025-34514)
CVE-2025-60013 OS Command Injection in F5Os A (CVE-2025-60013)
CVE-2025-53868 OS Command Injection in Big Ip Access Policy Manager (CVE-2025-53868)
CVE-2025-59051 The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap…
CVE-2025-5946 OS Command Injection in Infra Monitoring (CVE-2025-5946)
CVE-2025-10242 OS Command Injection in Ivanti Endpoint Manager Mobile (CVE-2025-10242)
CVE-2025-10243 OS Command Injection in Ivanti Endpoint Manager Mobile (CVE-2025-10243)
CVE-2025-10985 OS Command Injection in Ivanti Endpoint Manager Mobile (CVE-2025-10985)
CVE-2025-47856 OS Command Injection in Fortinet Fortivoice (CVE-2025-47856)
CVE-2025-9976 An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE…
CVE-2025-11665 Command Injection in D-Link DAP-2695 (CVE-2025-11665)
CVE-2025-60006 OS Command Injection in Juniper Junos OS Evolved (CVE-2025-60006)
CVE-2025-10239 OS Command Injection in Flowmon (CVE-2025-10239)
CVE-2025-57457 OS Command Injection in Curo UC300 (CVE-2025-57457)
CVE-2025-11491 Command Injection in wonderwhy-er DesktopCommanderMCP (CVE-2025-11491)
CVE-2025-11490 Command Injection in wonderwhy-er DesktopCommanderMCP (CVE-2025-11490)
CVE-2025-11407 Command Injection in D-Link DI-7001 MINI (CVE-2025-11407)
CVE-2025-54403 OS Command Injection in Planet (CVE-2025-54403)
CVE-2025-54404 OS Command Injection in Planet (CVE-2025-54404)
CVE-2025-54405 OS Command Injection in Planet (CVE-2025-54405)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details