Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,021
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 222769 Cwe 7872517 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...
CVE-2026-110536 Command Injection in D-Link DIR-868L (CVE-2026-110536)
CVE-2026-55679 OS Command Injection in WeGIA (CVE-2026-55679)
CVE-2026-54525 OS Command Injection in Markdown Preview Enhanced (CVE-2026-54525)
CVE-2026-102059 OS Command Injection in EX Series (CVE-2026-102059)
CVE-2026-102079 OS Command Injection in Junos OS (CVE-2026-102079)
CVE-2026-102031 OS Command Injection in Juniper Networks Junos OS Evolved (CVE-2026-102031)
CVE-2026-101967 OS Command Injection in Juniper Networks Junos OS Evolved (CVE-2026-101967)
CVE-2026-101978 OS Command Injection in PTX Series (CVE-2026-101978)
CVE-2026-110649 OS Command Injection in Stills (CVE-2026-110649)
CVE-2026-110643 OS Command Injection in transcribe2texts (CVE-2026-110643)
CVE-2026-110645 OS Command Injection in Video-stitch (CVE-2026-110645)
CVE-2026-110646 OS Command Injection in Beganovich snappdf (CVE-2026-110646)
CVE-2026-110644 OS Command Injection in nodejs-whisper (CVE-2026-110644)
CVE-2026-110650 The thumbnail Python package through 1.5 contains an OS command injection vulnerability in...
CVE-2026-110641 OS Command Injection in @runnerty/executor-decompress (CVE-2026-110641)
CVE-2026-110648 OS Command Injection in @offactory/compress-fonts (CVE-2026-110648)
CVE-2026-110647 OS Command Injection in Turnpress (CVE-2026-110647)
CVE-2026-110642 OS Command Injection in xhtml2pdf (CVE-2026-110642)
CVE-2026-110637 OS Command Injection in buildebooks (CVE-2026-110637)
CVE-2026-110640 OS Command Injection in Whisper-node (CVE-2026-110640)
CVE-2026-110636 OS Command Injection in pypdftk (CVE-2026-110636)
CVE-2026-110639 OS Command Injection in @mborne/extract (CVE-2026-110639)
CVE-2026-110634 OS Command Injection in git-diff (CVE-2026-110634)
CVE-2026-110638 OS Command Injection in doc-recog (CVE-2026-110638)
CVE-2026-110635 OS Command Injection in webp-converter (CVE-2026-110635)
CVE-2020-37282 OS Command Injection in office-converter (CVE-2020-37282)
CVE-2026-101215 OS Command Injection in Dell Unisphere for PowerMax vApp (CVE-2026-101215)
CVE-2026-16741 OS Command Injection in TR7 ASP (CVE-2026-16741)
CVE-2026-73792 OS Command Injection in HPE NonStop Java JToolkit (CVE-2026-73792)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details