Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-23855 Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell...
CVE-2026-79689 OS Command Injection in Dell SCG (CVE-2026-79689)
CVE-2026-79641 OS Command Injection in Dell SCG (CVE-2026-79641)
CVE-2026-87088 OS Command Injection in Enforce (CVE-2026-87088)
CVE-2026-78630 OS Command Injection in Okta Access Gateway (CVE-2026-78630)
CVE-2026-82004 OS Command Injection in Adobe Campaign Classic (CVE-2026-82004)
CVE-2026-81349 OS Command Injection in Azure HDInsights (CVE-2026-81349)
CVE-2026-86733 OS Command Injection in Snipe-IT (CVE-2026-86733)
CVE-2026-61517 OS Command Injection in Netis NX10 firmware (CVE-2026-61517)
CVE-2026-71376 OS Command Injection in Cosminexus Component Container (CVE-2026-71376)
CVE-2026-76561 OS Command Injection in Dogtag PKI (CVE-2026-76561)
CVE-2026-86540 OS Command Injection in knowns (CVE-2026-86540)
CVE-2026-80127 OS Command Injection in Dell SCG (CVE-2026-80127)
CVE-2026-19843 OS Command Injection in 389-ds-base (CVE-2026-19843)
CVE-2026-78488 OS Command Injection in Dell SCG (CVE-2026-78488)
CVE-2026-61409 OS Command Injection in Dell Secure Connect Gateway (CVE-2026-61409)
CVE-2026-86299 Command Injection in Linksys RE7000 (CVE-2026-86299)
CVE-2026-84256 OS Command Injection in OpenVPN (CVE-2026-84256)
CVE-2026-86167 Command Injection in Tenda HG10 (CVE-2026-86167)
CVE-2026-86152 Command Injection in Tenda CP3 (CVE-2026-86152)
CVE-2026-86151 Command Injection in Tenda CP3 (CVE-2026-86151)
CVE-2026-86148 Command Injection in Tenda CP3 (CVE-2026-86148)
CVE-2026-86149 Command Injection in Tenda CP3 (CVE-2026-86149)
CVE-2026-79423 An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of...
CVE-2026-78327 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...
CVE-2026-85656 OS Command Injection in Amazon Linux (CVE-2026-85656)
CVE-2026-18073 OS Command Injection in IBM i (CVE-2026-18073)
CVE-2026-17499 OS Command Injection in IBM i (CVE-2026-17499)
CVE-2026-16826 OS Command Injection in IBM i (CVE-2026-16826)
CVE-2026-85012 OS Command Injection in Amazon (CVE-2026-85012)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details