CWE-794 (对特殊元素的多个实例的过滤不完全) — Vulnerability Class 5

CWE-794 represents a critical input validation weakness where software fails to sanitize every occurrence of special characters or sequences within user-supplied data. Attackers typically exploit this vulnerability by injecting multiple instances of malicious payloads, such as nested HTML tags or repeated SQL operators, to bypass single-pass filtering mechanisms. By carefully crafting inputs that contain sequential or scattered special elements, adversaries can evade detection rules that only address the first or last instance, ultimately leading to successful cross-site scripting or injection attacks. Developers can prevent this flaw by implementing robust, multi-layered validation strategies that iterate through the entire input string. Utilizing comprehensive sanitization libraries that handle all occurrences, rather than relying on simple string replacements, ensures that no residual malicious content remains to compromise downstream components or execute unintended commands.