Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,021
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 222769 Cwe 7872517 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2026-104859 OS Command Injection in @nx/docker (CVE-2026-104859)
CVE-2026-93698 Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
CVE-2026-71452 OS Command Injection in EasyIO FS32 (CVE-2026-71452)
CVE-2026-71451 OS Command Injection in EasyIO FS32 (CVE-2026-71451)
CVE-2026-84682 OS Command Injection in Archer AX90 (CVE-2026-84682)
CVE-2026-12542 OS Command Injection in Foreman (CVE-2026-12542)
CVE-2026-12545 OS Command Injection in Ruby on Rails rubygem-hammer_cli (CVE-2026-12545)
CVE-2026-102294 OS Command Injection in TP-Link TL-WR841N (CVE-2026-102294)
CVE-2026-12541 OS Command Injection in Foreman (CVE-2026-12541)
CVE-2026-12540 OS Command Injection in Foreman (CVE-2026-12540)
CVE-2026-12405 OS Command Injection in rubygem-foreman_remote_execution (CVE-2026-12405)
CVE-2026-79898 OS Command Injection in Fortra BoKS Manager (CVE-2026-79898)
CVE-2026-76146 OS Command Injection in Genian SSL PNS (CVE-2026-76146)
CVE-2026-51870 OS Command Injection in DeepTutor (CVE-2026-51870)
CVE-2026-102120 OS Command Injection in Kiteworks (CVE-2026-102120)
CVE-2026-102114 OS Command Injection in Kiteworks (CVE-2026-102114)
CVE-2026-102112 OS Command Injection in Kiteworks (CVE-2026-102112)
CVE-2026-102096 OS Command Injection in Kiteworks Core (CVE-2026-102096)
CVE-2026-103473 OS Command Injection in Deno (CVE-2026-103473)
CVE-2026-100254 OS Command Injection in Jetbrains Teamcity (CVE-2026-100254)
CVE-2026-102911 Command Injection in zosmaai pi-llm-wiki (CVE-2026-102911)
CVE-2026-102906 Command Injection in 0xshariq github-mcp-server (CVE-2026-102906)
CVE-2026-102874 Command Injection in HKUDS AnyTool (CVE-2026-102874)
CVE-2026-78229 OS Command Injection in Image Scanner Driver for Linux (CVE-2026-78229)
CVE-2026-103056 OS Command Injection in AiSOC (CVE-2026-103056)
CVE-2026-102937 OS Command Injection in virtualenv (CVE-2026-102937)
CVE-2026-102925 OS Command Injection in virtualenv (CVE-2026-102925)
CVE-2026-79535 mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool ...
CVE-2026-100292 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled...
CVE-2026-102829 OS Command Injection in @simple-git/argv-parser (CVE-2026-102829)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details