CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 411 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-26222 | Dependabot 注入漏洞 — dependabot-core | 8.7 | High | 2020-11-13 |
| CVE-2020-15238 | Blueman 参数注入漏洞 — blueman | 7.1 | High | 2020-10-27 |
| CVE-2020-15255 | Anuko Time Tracker 注入漏洞 — timetracker | 8.7 | High | 2020-10-16 |
| CVE-2020-15227 | Nette 代码注入漏洞 — application | 8.7 | High | 2020-10-01 |
| CVE-2020-15140 | Red Discord Bot 代码注入漏洞 — Red-DiscordBot | 8.2 | High | 2020-08-21 |
| CVE-2020-15143 | Sylius ResourceBundle 注入漏洞 — SyliusResourceBundle | 7.7 | High | 2020-08-19 |
| CVE-2020-15146 | Sylius ResourceBundle 注入漏洞 — SyliusResourceBundle | 9.6 | Critical | 2020-08-19 |
| CVE-2020-15111 | Fiber 注入漏洞 — fiber | 4.2 | Medium | 2020-07-20 |
| CVE-2020-11060 | Teclib GLPI 跨站请求伪造漏洞 — GLPI | 7.4 | High | 2020-05-12 |
| CVE-2020-7489 | Schneider Electric EcoStruxure Machine Expert–Basic或SoMachine Basic 注入漏洞 — SoMachine Basic (all versions)EcoStruxure Machine Expert – Basic (all versions)Modicon M100 Logic Controller (all versions)Modicon M200 Logic Controller (all versions)Modicon M221 Logic Controller (all versions) | 9.8 | - | 2020-04-22 |
| CVE-2020-11002 | dropwizard-validation 注入漏洞 — dropwizard | 8.0 | High | 2020-04-10 |
| CVE-2020-7475 | 多款Schneider Electric产品注入漏洞 — EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10) | 9.8 | - | 2020-03-23 |
| CVE-2020-5245 | Dropwizard-Validation 注入漏洞 — dropwizard-validation | 7.9 | High | 2020-02-24 |
| CVE-2020-5219 | Angular Expressions 注入漏洞 — angular-expressions | 8.7 | High | 2020-01-24 |
| CVE-2019-11275 | Pivotal Software Application Manager 安全漏洞 — Apps Manager | 3.5 | - | 2019-10-01 |
| CVE-2019-1939 | Cisco Webex Teams 注入漏洞 — Cisco Webex Teams | 8.8 | - | 2019-09-05 |
| CVE-2019-3562 | Oculus Browser 跨站脚本漏洞 — Oculus Browser | 6.1 | - | 2019-04-29 |
| CVE-2019-1680 | Cisco Webex Business Suite 输入验证错误漏洞 — Cisco Webex Business Suite | 4.3 | - | 2019-02-07 |
| CVE-2018-18992 | LCDS LAquis SCADA 注入漏洞 — LCDS Laquis SCADA | 9.8 | - | 2019-02-05 |
| CVE-2018-18996 | LCDS LAquis SCADA 安全漏洞 — LCDS Laquis SCADA | 9.8 | - | 2019-02-05 |
| CVE-2017-16719 | Moxa NPort 5110、5130和5150 安全漏洞 — Moxa NPort 5110, 5130, and 5150 | 7.5 | - | 2017-11-16 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 411 条 CVE 漏洞。