CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 439 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-34062 | tqdm 安全漏洞 — tqdm | 4.8 | Medium | 2024-05-03 |
| CVE-2024-28234 | Contao 安全漏洞 — contao | 4.3 | Medium | 2024-04-09 |
| CVE-2024-28191 | Contao 安全漏洞 — contao | 3.1 | Low | 2024-04-09 |
| CVE-2024-3366 | XXL-JOB 注入漏洞 — xxl-job | 3.5 | Low | 2024-04-06 |
| CVE-2024-28867 | Prometheus 安全漏洞 — swift-prometheus | 5.9 | Medium | 2024-03-29 |
| CVE-2024-29896 | Astro-Shield 安全漏洞 — astro-shield | 7.5 | High | 2024-03-28 |
| CVE-2024-29027 | Parse Server 注入漏洞 — parse-server | 9.1 | Critical | 2024-03-19 |
| CVE-2024-23333 | LDAP Account Manager 注入漏洞 — lam | 7.9 | High | 2024-03-18 |
| CVE-2024-2445 | Mattermost 安全漏洞 — Mattermost | 6.1 | Medium | 2024-03-15 |
| CVE-2024-28181 | TurboBoost Commands 注入漏洞 — turbo_boost-commands | 8.1 | High | 2024-03-14 |
| CVE-2024-28114 | Peering Manager 注入漏洞 — peering-manager | 8.1 | High | 2024-03-12 |
| CVE-2024-21900 | QNAP Systems 多款产品注入漏洞 — QTS | 4.3 | Medium | 2024-03-08 |
| CVE-2024-21838 | Gallagher Command Centre 安全漏洞 — Command Centre Server | 6.8 | Medium | 2024-03-05 |
| CVE-2024-2064 | SelectCours 安全漏洞 — SelectCours | 4.3 | Medium | 2024-03-01 |
| CVE-2024-1619 | Kaspersky Security 安全漏洞 — Kaspersky Security for Linux Mail Server 8 | 6.1 | Medium | 2024-02-29 |
| CVE-2024-21742 | Apache James MIME4J 输入验证错误漏洞 — Apache James Mime4J | 5.3 | - | 2024-02-27 |
| CVE-2023-51388 | Hertzbeat 安全漏洞 — hertzbeat | 9.8 | Critical | 2024-02-22 |
| CVE-2023-51653 | Hertzbeat 安全漏洞 — hertzbeat | 9.8 | Critical | 2024-02-22 |
| CVE-2024-23830 | MantisBT 安全漏洞 — mantisbt | 8.3 | High | 2024-02-20 |
| CVE-2024-1128 | WordPress Plugin Tutor LMS 安全漏洞 — Tutor LMS – eLearning and online course solution | 5.4 | Medium | 2024-02-20 |
| CVE-2024-25625 | Pimcore 注入漏洞 — admin-ui-classic-bundle | 8.1 | High | 2024-02-19 |
| CVE-2024-22319 | IBM Operational Decision Manager 注入漏洞 — Operational Decision Manager | 8.1 | High | 2024-02-02 |
| CVE-2024-23828 | Nginx UI 注入漏洞 — nginx-ui | 8.8 | High | 2024-01-29 |
| CVE-2024-23648 | Pimcore 注入漏洞 — admin-ui-classic-bundle | 8.8 | High | 2024-01-24 |
| CVE-2023-42135 | PAX Technology A920 安全漏洞 — A920 Pro | 6.8 | Medium | 2024-01-15 |
| CVE-2023-4818 | PAX Technology A920 注入漏洞 — A920 | 4.6 | - | 2024-01-15 |
| CVE-2024-21645 | pyLoad 注入漏洞 — pyload | 5.3 | Medium | 2024-01-08 |
| CVE-2023-6004 | libssh 安全漏洞 — Red Hat Enterprise Linux 8 | 4.8 | Medium | 2024-01-03 |
| CVE-2024-21623 | OTCLient 注入漏洞 — otclient | 9.8 | Critical | 2024-01-02 |
| CVE-2023-7114 | Mattermost 安全漏洞 — Mattermost | 7.1 | High | 2023-12-29 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 439 条 CVE 漏洞。