Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,033

Image ID Title
CVE-2025-64328 KEV [KEV] OS Command Injection in Sangoma FreePBX (CVE-2025-64328)
CVE-2026-22222 OS Command Injection in TP-Link Archer BE230 (CVE-2026-22222)
CVE-2026-22226 OS Command Injection in Tp Link Archer Be230 Firmware (CVE-2026-22226)
CVE-2026-22223 OS Command Injection in TP-Link Archer BE230 (CVE-2026-22223)
CVE-2026-22221 OS Command Injection in TP-Link Archer BE230 (CVE-2026-22221)
CVE-2026-0631 OS Command Injection in TP-Link Archer BE230 (CVE-2026-0631)
CVE-2020-37002 OS Command Injection in Ajenti (CVE-2020-37002)
CVE-2025-57283 Code Injection in Node.js package browserstack-local (CVE-2025-57283)
CVE-2025-67264 OS Command Injection in Doogee Note59 (CVE-2025-67264)
CVE-2025-56590 OS Command Injection in Apryse HTML2PDF SDK thru (CVE-2025-56590)
CVE-2026-21267 OS Command Injection in Adobe macOS (CVE-2026-21267)
CVE-2025-13444 OS Command Injection in Progress LoadMaster (CVE-2025-13444)
CVE-2025-69262 OS Command Injection in pnpm (CVE-2025-69262)
CVE-2025-6225 Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to…
CVE-2025-15472 Command Injection in TRENDnet TEW-811DRU (CVE-2025-15472)
CVE-2025-15471 Command Injection in TRENDnet TEW-713RE (CVE-2025-15471)
CVE-2025-59156 OS Command Injection in Coolify (CVE-2025-59156)
CVE-2025-59157 OS Command Injection in Coolify (CVE-2025-59157)
CVE-2025-5965 OS Command Injection in Infra Monitoring (CVE-2025-5965)
CVE-2025-64124 OS Command Injection in Multi-Stack Controller (CVE-2025-64124)
CVE-2025-64120 OS Command Injection in Multi-Stack Controller (CVE-2025-64120)
CVE-2025-66398 OS Command Injection in Signal K Server (CVE-2025-66398)
CVE-2025-68700 OS Command Injection in RAGFlow (CVE-2025-68700)
CVE-2015-10145 OS Command Injection in Gargoyle router management utility (CVE-2015-10145)
CVE-2025-66203 OS Command Injection in StreamVault (CVE-2025-66203)
CVE-2025-68922 OS Command Injection in OpenOps (CVE-2025-68922)
CVE-2025-43876 Under certain circumstances a successful exploitation could result in access to the device.
CVE-2025-43875 Under certain circumstances a successful exploitation could result in access to the device.
CVE-2025-11774 OS Command Injection in Mitsubishi Electric GENESIS64 (CVE-2025-11774)
CVE-2025-65008 In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in…

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details