目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-74 输出中的特殊元素转义处理不恰当(注入) 类漏洞列表 441

CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 441 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。

MITRE CWE 官方描述
CWE：CWE-74 下游组件使用的输出中特殊元素的不当中和（'Injection'） 英文：产品使用来自上游组件的外部影响输入来构建命令、数据结构或记录的全部或部分内容，但在将其发送给下游组件时，未对可能修改其解析或解释方式的特殊元素进行中和，或中和不正确。
常见影响 (5)
ConfidentialityRead Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
OtherAlter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, OtherOther
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
缓解措施 (2)
RequirementsProgramming languages and supporting technologies might be chosen which are not subject to these issues.
ImplementationUtilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
代码示例 (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID标题CVSS风险等级Published
CVE-2024-56838 Siemens RUGGEDCOM ROX II 注入漏洞 — RUGGEDCOM ROX MX5000 7.2 High2025-12-09
CVE-2024-56835 Siemens RUGGEDCOM ROX II 注入漏洞 — RUGGEDCOM ROX MX5000 8.8 High2025-12-09
CVE-2025-66025 Caido 注入漏洞 — caido 4.3 Medium2025-11-26
CVE-2025-64428 Dataease 注入漏洞 — dataease 9.1 -2025-11-20
CVE-2025-13268 dataCompare 安全漏洞 — dataCompare 6.3 Medium2025-11-17
CVE-2025-64741 Zoom Workplace 安全漏洞 — Zoom Workplace for Android 8.1 High2025-11-13
CVE-2025-64099 OpenAM 注入漏洞 — OpenAM 4.3 -2025-11-12
CVE-2025-47286 Combodo iTop 注入漏洞 — iTop 9.1 -2025-11-10
CVE-2025-62697 MediaWiki - LanguageSelector Extension 安全漏洞 — Mediawiki - LanguageSelector Extension 9.8AICriticalAI2025-10-20
CVE-2025-61773 pyLoad 安全漏洞 — pyload 8.1 High2025-10-09
CVE-2025-11445 Kilo Code 安全漏洞 — Kilo Code 6.3 Medium2025-10-08
CVE-2025-7350 Rockwell Automation Stratix IOS 安全漏洞 — Stratix IOS 9.8AICriticalAI2025-09-09
CVE-2025-6785 Tesla Model 3 安全漏洞 — Model 3 6.1AIMediumAI2025-09-04
CVE-2025-9797 expressCart 安全漏洞 — expressCart 2.4 Low2025-09-01
CVE-2025-20265 Cisco Secure Firewall Management Center 注入漏洞 — Cisco Firepower Management Center 10.0 Critical2025-08-14
CVE-2025-20337 Cisco ISE和Cisco ISE-PIC 注入漏洞 — Cisco Identity Services Engine Software 10.0 Critical2025-07-16
CVE-2025-20284 Cisco ISE和Cisco ISE-PIC 注入漏洞 — Cisco Identity Services Engine Software 6.5 Medium2025-07-16
CVE-2025-20283 Cisco ISE和Cisco ISE-PIC 注入漏洞 — Cisco Identity Services Engine Software 6.5 Medium2025-07-16
CVE-2025-40710 Intersections Hotspot Shield VPN 注入漏洞 — Hotspot Shield VPN client 7.2AIHighAI2025-06-30
CVE-2025-53097 Roo Code 注入漏洞 — Roo-Code 5.9 Medium2025-06-27
CVE-2025-20281 Cisco ISE和Cisco ISE-PIC 注入漏洞 — Cisco Identity Services Engine Software 10.0 Critical2025-06-25
CVE-2025-47867 Trend Micro Apex Central 安全漏洞 — Trend Micro Apex Central 7.5 High2025-06-17
CVE-2025-32711 Microsoft M365 Copilot 命令注入漏洞 — Microsoft 365 Copilot 9.3 Critical2025-06-11
CVE-2025-20256 Cisco Secure Network Analytics Manager和Cisco Secure Network Analytics Virtual Manager 注入漏洞 — Cisco Secure Network Analytics 6.5 Medium2025-05-21
CVE-2025-48056 Hubble 注入漏洞 — hubble 5.3 Medium2025-05-20
CVE-2025-47948 Cocotais Bot 注入漏洞 — cocotais-bot 7.2 High2025-05-17
CVE-2025-32390 EspoCRM 注入漏洞 — espocrm 4.6AIMediumAI2025-05-12
CVE-2025-20216 Cisco Catalyst SD-WAN Manager 注入漏洞 — Cisco Catalyst SD-WAN Manager 4.7 Medium2025-05-07
CVE-2025-46814 fastapi-guard 注入漏洞 — fastapi-guard 3.4 Low2025-05-06
CVE-2025-3805 tournatrack 安全漏洞 — tournatrack 5.3 Medium2025-04-19

CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 441 条 CVE 漏洞。