目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-86 Web页面标识中非法字符转义处理不恰当 类漏洞列表 6

CWE-86 Web页面标识中非法字符转义处理不恰当 类弱点 6 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-86 属于输入验证缺陷，指应用未正确过滤标识符中间的非标准字符。攻击者常利用空字节或特殊编码绕过安全过滤，例如构造“java%00script:”以执行恶意脚本。开发者应实施严格的白名单验证，确保标识符仅包含合法字符，并对输入进行标准化处理，从而彻底阻断此类绕过攻击，保障Web页面安全。

MITRE CWE 官方描述
CWE：CWE-86 网页标识符中无效字符的不当中和 英文：产品未对标签名称、URI 方案和其他标识符中间的无效字符或字节序列进行中和，或中和不当。 某些 Web 浏览器可能会移除这些序列，从而导致输出可能产生非预期的控制影响。例如，产品可能试图移除 "javascript:" URI 方案，但 "java%00script:" URI 可能绕过此检查，并被某些浏览器仍呈现为活跃的 JavaScript，从而允许 XSS（跨站脚本攻击）或其他攻击。
常见影响 (1)
Confidentiality, Integrity, AvailabilityRead Application Data, Execute Unauthorized Code or Commands
缓解措施 (2)
ImplementationUse and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are i…
ImplementationTo help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is n…
Effectiveness: Defense in Depth
CVE ID标题CVSS风险等级Published
CVE-2026-28417 Vim 安全漏洞 — vim 4.4 Medium2026-02-27
CVE-2025-66606 Yokogawa FAST/TOOLS 安全漏洞 — FAST/TOOLS 8.3AIHighAI2026-02-09
CVE-2025-20168 Cisco Common Services Platform Collector 安全漏洞 — Cisco Common Services Platform Collector Software 5.4 Medium2025-01-08
CVE-2025-20167 Cisco Common Services Platform Collector 安全漏洞 — Cisco Common Services Platform Collector Software 5.4 Medium2025-01-08
CVE-2025-20166 Cisco Common Services Platform Collector 安全漏洞 — Cisco Common Services Platform Collector Software 5.4 Medium2025-01-08
CVE-2023-31126 XWiki Platform 跨站脚本漏洞 — xwiki-commons 9.1 Critical2023-05-09

CWE-86（Web页面标识中非法字符转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 6 条 CVE 漏洞。