Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2025-54406 OS Command Injection in Planet (CVE-2025-54406)
CVE-2025-60962 OS Command Injection in Endruntechnologies (CVE-2025-60962)
CVE-2025-60963 OS Command Injection in Endruntechnologies (CVE-2025-60963)
CVE-2025-60964 OS Command Injection in Endruntechnologies (CVE-2025-60964)
CVE-2025-60965 OS Command Injection in Endruntechnologies (CVE-2025-60965)
CVE-2025-60957 OS Command Injection in Endruntechnologies (CVE-2025-60957)
CVE-2025-60959 OS Command Injection in Endruntechnologies (CVE-2025-60959)
CVE-2025-60960 OS Command Injection in Endruntechnologies (CVE-2025-60960)
CVE-2025-11285 Command Injection in samanhappy MCPHub (CVE-2025-11285)
CVE-2025-60787 Vulnerability in motioneye (CVE-2025-60787)
CVE-2025-59741 Command Injection in AndSoft's e-TMS (CVE-2025-59741)
CVE-2025-59735 Command Injection in AndSoft's e-TMS (CVE-2025-59735)
CVE-2025-59736 Command Injection in AndSoft's e-TMS (CVE-2025-59736)
CVE-2025-59737 Command Injection in AndSoft's e-TMS (CVE-2025-59737)
CVE-2025-59738 Command Injection in AndSoft's e-TMS (CVE-2025-59738)
CVE-2025-59739 Command Injection in AndSoft's e-TMS (CVE-2025-59739)
CVE-2025-59740 Command Injection in AndSoft's e-TMS (CVE-2025-59740)
CVE-2014-6278 KEV [KEV] OS Command Injection in GNU Bash (CVE-2014-6278)
CVE-2025-36245 OS Command Injection in IBM InfoSphere (CVE-2025-36245)
CVE-2025-30247 OS Command Injection in Western Digital My Cloud firmware (CVE-2025-30247)
CVE-2025-11141 Command Injection in Ruijie NBR2100G-E (CVE-2025-11141)
CVE-2025-11138 Command Injection in mirweiye wenkucms (CVE-2025-11138)
CVE-2025-59844 SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command…
CVE-2025-11005 OS Command Injection in X6000R (CVE-2025-11005)
CVE-2025-34227 OS Command Injection in Nagios Xi (CVE-2025-34227)
CVE-2025-43943 OS Command Injection in Dell Cloud Disaster Recovery (CVE-2025-43943)
CVE-2025-27262 OS Command Injection in Ericsson Indoor Connect (CVE-2025-27262)
CVE-2025-59834 Command Injection in ADB MCP Server (CVE-2025-59834)
CVE-2025-59831 Command Injection in Riceball (CVE-2025-59831)
CVE-2025-59534 OS Command Injection in Nasa (CVE-2025-59534)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details