Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2025-31693 OS Command Injection in Drupal AI (CVE-2025-31693)
CVE-2025-1316 KEV [KEV] OS Command Injection in Edimax IC-7100 IP Camera (CVE-2025-1316)
CVE-2025-1244 OS Command Injection in Emacs text editor (CVE-2025-1244)
CVE-2024-40891 KEV [KEV] OS Command Injection in Zyxel DSL CPE Devices (CVE-2024-40891)
CVE-2024-40890 KEV [KEV] OS Command Injection in Zyxel DSL CPE Devices (CVE-2024-40890)
CVE-2018-9276 KEV [KEV] OS Command Injection in Paessler PRTG Network Monitor (CVE-2018-9276)
CVE-2024-50603 KEV [KEV] OS Command Injection in Aviatrix Controllers (CVE-2024-50603)
CVE-2024-12686 KEV [KEV] OS Command Injection in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) (CVE-2024-12686)
CVE-2024-12970 OS Command Injection in Pardus OS My Computer (CVE-2024-12970)
CVE-2021-40407 KEV [KEV] OS Command Injection in Reolink RLC-410W IP Camera (CVE-2021-40407)
CVE-2019-11001 KEV [KEV] OS Command Injection in Reolink Multiple IP Cameras (CVE-2019-11001)
CVE-2018-14933 KEV [KEV] OS Command Injection in NUUO NVRmini Devices (CVE-2018-14933)
CVE-2024-51378 KEV [KEV] Vulnerability in CyberPersons CyberPanel (CVE-2024-51378)
CVE-2024-52723 OS Command Injection in Totolink (CVE-2024-52723)
CVE-2024-9474 KEV [KEV] Command Injection in Palo Alto Networks PAN-OS (CVE-2024-9474)
CVE-2024-1212 KEV [KEV] OS Command Injection in Progress Kemp LoadMaster (CVE-2024-1212)
CVE-2024-9463 KEV [KEV] OS Command Injection in Palo Alto Networks Expedition (CVE-2024-9463)
CVE-2024-10035 Command Injection in CoslatV3 (CVE-2024-10035)
CVE-2024-8957 KEV [KEV] OS Command Injection in PTZOptics PT30X-SDI/NDI Cameras (CVE-2024-8957)
CVE-2020-15415 KEV [KEV] OS Command Injection in DrayTek Multiple Vigor Routers (CVE-2020-15415)
CVE-2023-25280 KEV [KEV] OS Command Injection in D-Link DIR-820 Router (CVE-2023-25280)
CVE-2024-8190 KEV [KEV] OS Command Injection in Ivanti Cloud Services Appliance (CVE-2024-8190)
CVE-2024-6917 OS Command Injection in Veribase Order Management (CVE-2024-6917)
CVE-2024-38887 OS Command Injection in Horizon Business Services Inc (CVE-2024-38887)
CVE-2024-38889 SQL Injection in Horizon Business Services Inc (CVE-2024-38889)
CVE-2024-38882 OS Command Injection in Horizon Business Services Inc (CVE-2024-38882)
CVE-2024-20399 KEV [KEV] OS Command Injection in Cisco NX-OS (CVE-2024-20399)
CVE-2024-37626 OS Command Injection in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware (CVE-2024-37626)
CVE-2024-4577 KEV [KEV] OS Command Injection in PHP Group PHP (CVE-2024-4577)
CVE-2017-3506 KEV [KEV] OS Command Injection in Oracle WebLogic Server (CVE-2017-3506)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details