目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-74 输出中的特殊元素转义处理不恰当(注入) 类漏洞列表 375

CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 375 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。

MITRE CWE 官方描述
CWE：CWE-74 下游组件使用的输出中特殊元素的不当中和（'Injection'） 英文：产品使用来自上游组件的外部影响输入来构建命令、数据结构或记录的全部或部分内容，但在将其发送给下游组件时，未对可能修改其解析或解释方式的特殊元素进行中和，或中和不正确。
常见影响 (5)
ConfidentialityRead Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
OtherAlter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, OtherOther
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
缓解措施 (2)
RequirementsProgramming languages and supporting technologies might be chosen which are not subject to these issues.
ImplementationUtilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
代码示例 (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID标题CVSS风险等级Published
CVE-2025-67486 Dolibarr 用户额外字段认证远程代码执行漏洞 — dolibarr--2026-05-08
CVE-2026-26164 Microsoft 365 Copilot 信息泄露漏洞 — Microsoft 365 Copilot's Business Chat 7.5 High2026-05-07
CVE-2026-7045 dynamic-datasource-spring-boot-starter 注入漏洞 — dynamic-datasource 6.3 Medium2026-04-26
CVE-2026-6994 Envoy Proxy 注入漏洞 — Envoy 6.3 Medium2026-04-25
CVE-2026-41319 MailKit 注入漏洞 — MailKit 6.5 Medium2026-04-24
CVE-2026-1089 Fortra GoAnywhere MFT 安全漏洞 — GoAnywhere MFT 6.5 Medium2026-04-21
CVE-2026-0972 Fortra GoAnywhere MFT 安全漏洞 — GoAnywhere MFT 5.4 Medium2026-04-21
CVE-2026-6599 Langflow 安全漏洞 — langflow 6.3 Medium2026-04-20
CVE-2026-5797 WordPress plugin Quiz And Survey Master 安全漏洞 — Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker 5.3 Medium2026-04-17
CVE-2026-39419 MaxKB 安全漏洞 — MaxKB 3.1 Low2026-04-14
CVE-2026-35515 nest 注入漏洞 — nest 6.5AIMediumAI2026-04-07
CVE-2026-5561 CampCodes Complete POS Management and Inventory 安全漏洞 — Complete POS Management and Inventory System 6.3 Medium2026-04-05
CVE-2026-34767 Electron 注入漏洞 — electron 5.9 Medium2026-04-03
CVE-2026-34041 Act 注入漏洞 — act 7.1AIHighAI2026-03-31
CVE-2026-5002 LocalGPT 安全漏洞 — localGPT 7.3 High2026-03-28
CVE-2026-32695 Traefik 注入漏洞 — traefik 10.0 -2026-03-27
CVE-2026-33148 Tandoor Recipes 注入漏洞 — recipes 6.5 Medium2026-03-26
CVE-2026-30932 Froxlor 注入漏洞 — froxlor 7.5 -2026-03-24
CVE-2026-33475 Langflow 操作系统命令注入漏洞 — langflow 9.1 Critical2026-03-24
CVE-2026-33202 Rails 注入漏洞 — activestorage 8.1 -2026-03-23
CVE-2026-4516 MetaGPT 安全漏洞 — MetaGPT 6.3 Medium2026-03-21
CVE-2026-4511 Vanna 安全漏洞 — vanna 6.3 Medium2026-03-21
CVE-2026-4500 bagofwords 安全漏洞 — bagofwords 6.3 Medium2026-03-20
CVE-2026-32616 Pigeon 注入漏洞 — Pigeon 8.2 High2026-03-13
CVE-2026-3992 Serverless Express 安全漏洞 — serverless-express 6.3 Medium2026-03-12
CVE-2026-29777 Traefik 注入漏洞 — traefik 5.4AIMediumAI2026-03-11
CVE-2026-31816 Budibase 注入漏洞 — budibase 9.1 Critical2026-03-09
CVE-2026-3813 JFlow 安全漏洞 — JFlow 6.3 Medium2026-03-09
CVE-2026-29053 Ghost 注入漏洞 — Ghost 7.7 High2026-03-05
CVE-2026-29085 Hono 注入漏洞 — hono 6.5 Medium2026-03-04

CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 375 条 CVE 漏洞。