Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 441

441 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
ConfidentialityRead Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
OtherAlter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, OtherOther
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
RequirementsProgramming languages and supporting technologies might be chosen which are not subject to these issues.
ImplementationUtilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE IDTitleCVSSSeverityPublished
CVE-2026-15441 Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter — Product Table & List Builder For WooCommerce 5.3 Medium2026-08-16
CVE-2026-12618 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access — Security Verify Access 7.2 High2026-08-12
CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text — flawfinder 8.7 High2026-08-11
CVE-2026-48120 Kakoune has a Critical RCE via Autorestore Backup Filename Injection — kakoune 8.6 High2026-08-07
CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input — html_sanitize_ex 2.3 Low2026-08-06
CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props — nuxt 8.1 High2026-08-05
CVE-2026-20272 Cisco IOS XE Software Security Hardening Release — Cisco IOS XE Software 9.8 Critical2026-08-05
CVE-2026-18613 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection — GL-MT3000 9.8 Critical2026-08-03
CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names — GitPython 7.0 High2026-08-03
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution — logging-operator 9.9 Critical2026-07-29
CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields — undici 4.8 Medium2026-07-29
CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-54664 swagger-typescript-api vulnerable to code injection via unescaped enum string values — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-18085 Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM — UEM 5.9 Medium2026-07-28
CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE — ps_facetedsearch 10.0 Critical2026-07-17
CVE-2026-44182 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering — enterprise_gateway--2026-07-16
CVE-2026-58493 grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction — grav--2026-07-10
CVE-2026-55615 Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 — langroid--2026-07-09
CVE-2026-0284 PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) — Cloud NGFW 4.7 Medium2026-07-09
CVE-2026-58213 NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection — nats-server 7.1 High2026-07-08
CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output — yt-dlp 7.5 High2026-07-08
CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` — coder 8.3 High2026-07-07
CVE-2026-49099 Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour — Apache Camel Salesforce--2026-07-06
CVE-2026-48203 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields — Apache Camel--2026-07-06
CVE-2026-14249 Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter — Request a Quote – Quote Forms for Any WordPress Site 7.5 High2026-07-02
CVE-2026-57522 Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates — server 3.5 Low2026-06-25
CVE-2026-50574 yt-dlp: Arbitrary code execution via manifest downloads with aria2c — yt-dlp 8.3 High2026-06-23
CVE-2026-12888 HTML injection in the Canarytoken Google Chat notification — Canarytokens--2026-06-22

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 441 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.