Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-14499 OS Command Injection in Langflow macOS (CVE-2026-14499)
CVE-2026-58195 OS Command Injection in agentic-flow (CVE-2026-58195)
CVE-2026-55578 OS Command Injection in pheditor/pheditor (CVE-2026-55578)
CVE-2026-54540 OS Command Injection in pheditor/pheditor (CVE-2026-54540)
CVE-2026-14371 OS Command Injection in Lenovo XClarity Integrator for Windows Admin Center plugin (CVE-2026-14371)
CVE-2026-63305 OS Command Injection in AVideo (CVE-2026-63305)
CVE-2026-63304 OS Command Injection in AVideo (CVE-2026-63304)
CVE-2023-49900 An unauthenticated remote attacker is able to perform remote code execution due to incorrectly...
CVE-2026-39808 KEV [KEV] OS Command Injection in Fortinet FortiSandbox (CVE-2026-39808)
CVE-2026-50289 OS Command Injection in systeminformation (CVE-2026-50289)
CVE-2026-55576 MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow…
CVE-2026-52891 OS Command Injection in Wekan (CVE-2026-52891)
CVE-2026-55410 OS Command Injection in @nocobase/plugin-backups (CVE-2026-55410)
CVE-2026-62312 OS Command Injection in 9Router (CVE-2026-62312)
CVE-2026-15895 OS Command Injection in Amazon jsii-diff (CVE-2026-15895)
CVE-2026-46709 Command Injection in Tabby (CVE-2026-46709)
CVE-2026-61438 OS Command Injection in PraisonAI (CVE-2026-61438)
CVE-2026-48347 OS Command Injection in Adobe macOS (CVE-2026-48347)
CVE-2026-48345 OS Command Injection in Adobe macOS (CVE-2026-48345)
CVE-2026-15427 OS Command Injection in Archer VX1800v (CVE-2026-15427)
CVE-2026-15428 OS Command Injection in Archer VX800v (CVE-2026-15428)
CVE-2026-58479 OS Command Injection in Dan In Ca (CVE-2026-58479)
CVE-2026-62392 OS Command Injection in Apache Kylin (CVE-2026-62392)
CVE-2026-3014 OS Command Injection in Milestone has released a new (CVE-2026-3014)
CVE-2026-14852 Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0...
CVE-2026-15669 Command Injection in louisho5 picobot (CVE-2026-15669)
CVE-2026-60121 OS Command Injection in Vitec Flamingo (CVE-2026-60121)
CVE-2026-61498 OS Command Injection in Vitec Flamingo (CVE-2026-61498)
CVE-2026-22100 The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating...
CVE-2026-15546 Command Injection in Shibby Tomato (CVE-2026-15546)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details