Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-159 (特殊元素净化处理不恰当) — Vulnerability Class 10

10 vulnerabilities classified as CWE-159 (特殊元素净化处理不恰当). AI Chinese analysis included.

CWE-159 represents a critical input validation weakness where software fails to properly sanitize or escape special characters within user-controlled data. This flaw typically allows attackers to inject malicious syntax, such as SQL commands, script tags, or shell operators, which the application interprets as executable logic rather than literal data. By bypassing expected parsing rules, adversaries can manipulate system behavior, compromise data integrity, or execute arbitrary code. To mitigate this risk, developers must implement rigorous input validation strategies, ensuring all special elements are strictly filtered, quoted, or encoded before processing. Utilizing parameterized queries for database interactions and context-aware output encoding for web rendering further prevents these injection vectors, thereby preserving the application’s security posture against unintended command execution.

MITRE CWE Description
The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.
Common Consequences (1)
IntegrityUnexpected State
Mitigations (4)
Developers should anticipate that special elements will be injected/removed/manipulated in the input vectors of their software system. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
ImplementationWhile it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or whit…
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CVE IDTitleCVSSSeverityPublished
CVE-2026-35536 Tornado 安全漏洞 — Tornado 7.2 High2026-04-03
CVE-2026-2636 Denial of Service in Microsoft OS — Windows OS 5.5 Medium2026-02-25
CVE-2025-61984 OpenSSH 安全漏洞 — OpenSSH 3.6 Low2025-10-06
CVE-2025-52884 risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitment — risc0-ethereum--AI2025-06-24
CVE-2021-21707 Special characters break path parsing in XML functions — PHP 5.3 Medium2021-11-29
CVE-2021-42375 BusyBox 安全漏洞 — busybox 5.5 -2021-11-15
CVE-2020-29022 Host Header Injection allowing web cache poisoning attacks — GateManager 5.3 Medium2021-02-16
CVE-2020-1653 Junos OS: Kernel crash (vmcore) or FPC crash due to mbuf leak — Junos OS 7.5 High2020-07-17
CVE-2020-1648 Junos OS and Junos OS Evolved: RPD crash when processing a specific BGP packet — Junos OS 7.5 High2020-07-17
CVE-2019-9505 PrinterLogic Print Management Software does not sanitize special characters — Management Software 9.8 -2019-05-08

Vulnerabilities classified as CWE-159 (特殊元素净化处理不恰当) represent 10 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.