Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 120
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 9484 Cwe 50270 Cwe 7966 Cwe 8954 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 1,313

ID Title
CVE-2026-16022 OS Command Injection in CVE-2026-16022 (CVE-2026-16022)
CVE-2026-71243 OS Command Injection in CVE-2026-71243 (CVE-2026-71243)
CVE-2026-70375 OS Command Injection in CVE-2026-70375 (CVE-2026-70375)
CVE-2026-70374 OS Command Injection in CVE-2026-70374 (CVE-2026-70374)
CVE-2026-18900 Command Injection in CVE-2026-18900 (CVE-2026-18900)
CVE-2026-66902 OS Command Injection in c (CVE-2026-66902)
CVE-2026-16793 Vulnerability in CVE-2026-16793 (CVE-2026-16793)
CVE-2026-6837 OS Command Injection in CVE-2026-6837 (CVE-2026-6837)
CVE-2026-52102 OS Command Injection in CVE-2026-52102 (CVE-2026-52102)
CVE-2026-51190 OS Command Injection in CVE-2026-51190 (CVE-2026-51190)
CVE-2026-67599 OS Command Injection in CVE-2026-67599 (CVE-2026-67599)
CVE-2026-18641 Command Injection in CVE-2026-18641 (CVE-2026-18641)
CVE-2026-69096 OS Command Injection in CVE-2026-69096 (CVE-2026-69096)
CVE-2026-67608 OS Command Injection in apache (CVE-2026-67608)
CVE-2026-18590 Command Injection in CVE-2026-18590 (CVE-2026-18590)
CVE-2026-18587 Command Injection in CVE-2026-18587 (CVE-2026-18587)
CVE-2026-67324 OS Command Injection in CVE-2026-67324 (CVE-2026-67324)
CVE-2026-67325 OS Command Injection in CVE-2026-67325 (CVE-2026-67325)
CVE-2026-67308 OS Command Injection in CVE-2026-67308 (CVE-2026-67308)
CVE-2026-9044 OS Command Injection in tp-link (CVE-2026-9044)
CVE-2026-17566 OS Command Injection in pgadmin (CVE-2026-17566)
CVE-2026-17347 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an...
CVE-2026-16843 OS Command Injection in CVE-2026-16843 (CVE-2026-16843)
CVE-2026-12943 OS Command Injection in ibm (CVE-2026-12943)
CVE-2026-12940 OS Command Injection in langflow (CVE-2026-12940)
CVE-2026-14522 OS Command Injection in ibm (CVE-2026-14522)
CVE-2026-22622 OS Command Injection in CVE-2026-22622 (CVE-2026-22622)
CVE-2026-22621 OS Command Injection in CVE-2026-22621 (CVE-2026-22621)
CVE-2026-44106 A privilege escalation vulnerability in the init-script for user-applications allows a low...
CVE-2026-44099 A privilege escalation vulnerability in the system configuration allows a low-privileged local...

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →