CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 440 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-46983 | SOFA-Hessian 注入漏洞 — sofa-hessian | 9.8 | Critical | 2024-09-19 |
| CVE-2024-46986 | CamaleonCMS 注入漏洞 — camaleon-cms | 10.0 | Critical | 2024-09-18 |
| CVE-2024-6702 | Pegasystem PEGA Platform 安全漏洞 — Pega Infinity | 5.2 | Medium | 2024-09-12 |
| CVE-2024-8367 | Probate Back Office 注入漏洞 — Probate Back Office | 3.5 | Low | 2024-09-01 |
| CVE-2024-43782 | Open edX openedx-translations 安全漏洞 — openedx-translations | 7.7 | High | 2024-08-23 |
| CVE-2024-42472 | Flatpak 安全漏洞 — flatpak | 10.0 | Critical | 2024-08-15 |
| CVE-2024-42489 | xwiki-pro-macros 安全漏洞 — xwiki-pro-macros | 10.0 | Critical | 2024-08-12 |
| CVE-2024-6331 | Devika 信息泄露漏洞 — stitionai/devika | 7.5 | High | 2024-08-04 |
| CVE-2024-41127 | Monkeytype 安全漏洞 — monkeytype | 8.4 | High | 2024-08-02 |
| CVE-2024-39320 | Discourse 安全漏洞 — discourse | 6.1 | Medium | 2024-07-30 |
| CVE-2024-26020 | Ankitects Anki 注入漏洞 — Anki | 9.6 | Critical | 2024-07-22 |
| CVE-2024-41122 | Woodpecker 安全漏洞 — woodpecker | 7.5 | High | 2024-07-19 |
| CVE-2024-41121 | Woodpecker 安全漏洞 — woodpecker | 8.8 | High | 2024-07-19 |
| CVE-2024-39906 | Haven 安全漏洞 — haven | 8.4 | High | 2024-07-19 |
| CVE-2024-41111 | Sliver 安全漏洞 — sliver | 7.2 | High | 2024-07-18 |
| CVE-2024-20429 | Cisco Secure Email 安全漏洞 — Cisco Secure Email | 6.5 | Medium | 2024-07-17 |
| CVE-2024-40637 | dbt 安全漏洞 — dbt-core | 4.2 | Medium | 2024-07-16 |
| CVE-2024-38700 | WordPress plugin WPCS 注入漏洞 — WPCS | 6.5 | Medium | 2024-07-12 |
| CVE-2024-36522 | Apache Wicket 注入漏洞 — Apache Wicket | 9.8AI | CriticalAI | 2024-07-12 |
| CVE-2024-37442 | WordPress plugin Photo Gallery by Ays 注入漏洞 — Photo Gallery by Ays | 3.8 | Low | 2024-07-09 |
| CVE-2024-37253 | WordPress plugin WP Directory Kit 注入漏洞 — WP Directory Kit | 2.7 | Low | 2024-07-09 |
| CVE-2024-35777 | WordPress plugin WooCommerce 注入漏洞 — WooCommerce | 3.5 | Low | 2024-07-09 |
| CVE-2024-6470 | playSMS 注入漏洞 — playSMS | 2.7 | Low | 2024-07-03 |
| CVE-2024-6469 | playSMS 注入漏洞 — playSMS | 2.7 | Low | 2024-07-03 |
| CVE-2024-38366 | CocoaPods 安全漏洞 — CocoaPods | 10.0 | Critical | 2024-07-01 |
| CVE-2024-36420 | Flowise 安全漏洞 — Flowise | 7.5 | High | 2024-07-01 |
| CVE-2024-35728 | WordPress plugin PPOM for WooCommerce 注入漏洞 — PPOM for WooCommerce | 5.3 | Medium | 2024-06-10 |
| CVE-2024-5184 | EmailGPT 安全漏洞 — EmailGPT | 6.5 | Medium | 2024-06-05 |
| CVE-2023-23738 | WordPress plugin Spectra 注入漏洞 — Spectra | 5.3 | Medium | 2024-06-03 |
| CVE-2024-34697 | FreeScout 注入漏洞 — freescout | 7.6 | High | 2024-05-13 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 440 条 CVE 漏洞。