Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2026-49814 OS Command Injection in Dell PowerProtect Data Domain (CVE-2026-49814)
CVE-2026-49815 OS Command Injection in Dell PowerProtect Data Domain (CVE-2026-49815)
CVE-2026-49813 OS Command Injection in Dell PowerProtect Data Domain (CVE-2026-49813)
CVE-2026-54483 OS Command Injection in Dell PowerProtect Data Domain (CVE-2026-54483)
CVE-2026-26355 OS Command Injection in Dell PowerProtect Data Domain (CVE-2026-26355)
CVE-2026-59800 OS Command Injection in 9router (CVE-2026-59800)
CVE-2026-49255 OS Command Injection in electerm (CVE-2026-49255)
CVE-2026-44454 OS Command Injection in github.com/coder/coder/v2 (CVE-2026-44454)
CVE-2026-58455 OS Command Injection in Dockwatch (CVE-2026-58455)
CVE-2026-56004 A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0...
CVE-2026-58652 luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd...
CVE-2026-58457 OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater (CVE-2026-58457)
CVE-2026-13760 OS Command Injection in Amazon aws-cdk-lib (CVE-2026-13760)
CVE-2026-58452 OS Command Injection in JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware (CVE-2026-58452)
CVE-2026-34112 Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac...
CVE-2026-34114 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34117 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34110 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34113 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34108 Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php ...
CVE-2026-34111 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34116 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34115 Guardian language-system passes the id GET parameter directly into a PHP exec() call in...
CVE-2026-34106 Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles...
CVE-2026-34109 Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech...
CVE-2026-34107 Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate...
CVE-2026-50043 OS Command Injection in SkyBridge MB-A100/MB-A110 (CVE-2026-50043)
CVE-2026-56413 OS Command Injection in Storage Concentrator (CVE-2026-56413)
CVE-2026-56415 OS Command Injection in Storage Concentrator (CVE-2026-56415)
CVE-2026-56700 OS Command Injection in Grav CMS (CVE-2026-56700)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details