Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-80412 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-80412)
CVE-2026-80425 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-80425)
CVE-2026-82369 Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting...
CVE-2026-80379 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-80379)
CVE-2026-6721 OS Command Injection in IBM Concert (CVE-2026-6721)
CVE-2026-87898 OS Command Injection in Plesk (CVE-2026-87898)
CVE-2026-77601 OS Command Injection in openc3 (CVE-2026-77601)
CVE-2026-93349 OS Command Injection in Frictionless (CVE-2026-93349)
CVE-2026-76978 OS Command Injection in ZohoCorp ManageEngine OpManager (CVE-2026-76978)
CVE-2026-19599 OS Command Injection in ZohoCorp ManageEngine OpManager MSP (CVE-2026-19599)
CVE-2026-15027 CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated...
CVE-2026-50227 An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket...
CVE-2026-94367 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection...
CVE-2026-16672 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-16672)
CVE-2026-17102 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-17102)
CVE-2026-16469 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-16469)
CVE-2026-16468 OS Command Injection in IBM DataStage on Cloud Pak for Data (CVE-2026-16468)
CVE-2026-76714 OS Command Injection in Arubanetworks (CVE-2026-76714)
CVE-2026-95660 Command Injection in Moonshot AI Kimi Code (CVE-2026-95660)
CVE-2026-85288 Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml…
CVE-2026-43641 OS Command Injection in Softaculous Virtualizor (CVE-2026-43641)
CVE-2026-76802 OS Command Injection in github.com/projectdiscovery/nuclei/v3 (CVE-2026-76802)
CVE-2026-80152 OS Command Injection in Lantronix SLC8000 before firmware (CVE-2026-80152)
CVE-2026-80151 OS Command Injection in Lantronix SLC8000 before firmware (CVE-2026-80151)
CVE-2026-80145 OS Command Injection in Lantronix SLC8000 before firmware (CVE-2026-80145)
CVE-2026-80144 OS Command Injection in Lantronix SLC8000 before firmware (CVE-2026-80144)
CVE-2026-80143 OS Command Injection in Lantronix SLC8000 before firmware (CVE-2026-80143)
CVE-2026-65130 OS Command Injection in NVIDIA Infrastructure Controller for Linux (CVE-2026-65130)
CVE-2026-95675 OS Command Injection in D-Link DAP-1360 firmware (CVE-2026-95675)
CVE-2026-74849 OS Command Injection in Zohocorp ManageEngine ADSelfService Plus (CVE-2026-74849)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details