CWE-116 对输出编码和转义不恰当 类弱点 145 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-116 属于输出编码或转义不当漏洞，指产品在向其他组件发送结构化消息时，未正确编码或转义数据，导致消息结构被破坏。攻击者常借此注入恶意命令，篡改预期逻辑以执行非法操作。开发者应避免此风险，需严格遵循上下文相关的编码规范，对输出数据进行彻底验证与转义，确保特殊字符被正确隔离，从而维持消息结构的完整性与安全性。
<% String email = request.getParameter("email"); %> ... Email Address: <%= email %>$inputString = readLineFromFileHandle($serverFH); # generate an array of strings separated by the "|" character. @commands = split(/\|/, $inputString); foreach $cmd (@commands) { # separate the operator from its arguments based on a single whitespace ($operator, $args) = split(/ /, $cmd, 2); $args = UrlDecode($args); if ($operator eq "BAN") { ExecuteBan($args); } elsif ($operator eq "SAY") { ExecuteSay($args); } }$inputString = GetUntrustedArgument("command"); ($cmd, $argstr) = split(/\s+/, $inputString, 2); # removes extra whitespace and also changes CRLF's to spaces $argstr =~ s/\s+/ /gs; $argstr = UrlEncode($argstr); if (($cmd eq "BAN") && (! IsAdministrator($username))) { die "Error: you are not the admin.\n"; } # communicate with file server using a file handle $fh = GetServerFileHandle("myserver"); print $fh "$cmd $argstr\n";CWE-116（对输出编码和转义不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 145 条 CVE 漏洞。