CWE-117 日志输出的转义处理不恰当 类弱点 101 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-117属于日志注入漏洞，指程序在记录日志时未对来自外部的输入进行适当的净化处理。攻击者通常利用此缺陷，通过构造包含换行符或特殊字符的恶意输入，强行插入伪造的日志条目，从而掩盖真实攻击痕迹或误导安全分析人员。开发者应避免直接将用户输入拼接至日志字符串，而应采用安全的日志API，并对输入数据进行严格的过滤、转义或验证，确保日志内容的完整性与可信度。
String val = request.getParameter("val"); try { int value = Integer.parseInt(val); } catch (NumberFormatException) { log.info("Failed to parse val = " + val); } ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-16188 | IBM WebSphere 9.0.5.29 及 8.5.5.31 前多漏洞 — WebSphere Application Server | 5.3 | Medium | 2026-09-14 |
| CVE-2026-16189 | IBM WebSphere Application Server 9.0.5.29 及 8.5.5.31 前多漏洞 — WebSphere Application Server | 4.8 | Medium | 2026-09-14 |
| CVE-2026-87859 | Morgan 日志注入漏洞 — morgan | 5.3 | Medium | 2026-09-11 |
| CVE-2026-14350 | IBM Cloud Pak for Data System 输出处理不当漏洞 — Cloud Pak for Data System | 5.3 | Medium | 2026-09-04 |
| CVE-2026-9736 | IBM Netezza Software 输出处理不当漏洞 — Netezza Software | 5.3 | Medium | 2026-09-03 |
| CVE-2026-15603 | expressjs morgan 输出处理不当漏洞 — morgan | 5.3 | Medium | 2026-08-28 |
| CVE-2026-81696 | Tobi OpenSSL Encrypt 输出处理不当漏洞 — openssl_encrypt | 3.3 | Low | 2026-08-27 |
| CVE-2026-81695 | Tobi OpenSSL Encrypt 输出处理不当漏洞 — openssl_encrypt | 3.3 | Low | 2026-08-27 |
| CVE-2026-81694 | Tobi OpenSSL Encrypt 输出处理不当漏洞 — openssl_encrypt | 3.3 | Low | 2026-08-27 |
| CVE-2026-44256 | Wazuh 输出处理不当漏洞 — wazuh | 5.3 | Medium | 2026-08-19 |
| CVE-2026-74885 | jahlives openssl_encrypt 输出处理不当漏洞 — openssl_encrypt | 3.6 | Low | 2026-08-17 |
| CVE-2026-17481 | IBM Documentation Offline 输出处理不当漏洞 — Documentation Offline | 8.8 | High | 2026-08-13 |
| CVE-2026-18148 | IBM i 输出处理不当漏洞 — i | 4.3 | Medium | 2026-08-12 |
| CVE-2026-48083 | open-reception appointment-booking-software 输出处理不当漏洞 — appointment-booking-software | 6.5 | Medium | 2026-08-06 |
| CVE-2026-12616 | Eclipse Project Identity Authority 输出处理不当漏洞 — Eclipse CSI - PIA | - | - | 2026-06-29 |
| CVE-2026-10745 | upKeeper Instant Privilege Access 输出处理不当漏洞 — upKeeper Instant Privilege Access | - | - | 2026-06-24 |
| CVE-2026-20260 | Splunk SOAR 安全漏洞 — Splunk SOAR | 4.3 | Medium | 2026-06-10 |
| CVE-2026-9016 | WordPress plugin Debug Log Manager – Conveniently Monitor and Inspect Errors 安全漏洞 — Debug Log Manager – Conveniently Monitor and Inspect Errors | 5.3 | Medium | 2026-06-06 |
| CVE-2026-5078 | morgan 安全漏洞 — morgan | 5.3 | Medium | 2026-06-03 |
| CVE-2026-45679 | OpenTelemetry eBPF Instrumentation 安全漏洞 — opentelemetry-ebpf-instrumentation | 6.5 | Medium | 2026-06-02 |
| CVE-2026-6494 | Red Hat Ansible Automation Platform（Red Hat AAP） 安全漏洞 — Red Hat Ansible Automation Platform 2 | 5.3 | Medium | 2026-04-17 |
| CVE-2025-14684 | IBM Maximo Application Suite - Monitor Component 安全漏洞 — Maximo Application Suite - Monitor Component | 4.0 | Medium | 2026-03-25 |
| CVE-2025-59784 | 2N Access Commander 安全漏洞 — 2N Access Commander | 6.5AI | Medium AI | 2026-03-04 |
| CVE-2025-12755 | IBM MQ 安全漏洞 — MQ Operator | 4.0 | Medium | 2026-02-17 |
| CVE-2025-11537 | Keycloak 安全漏洞 — Red Hat Build of Keycloak | 5.0 | Medium | 2026-02-10 |
| CVE-2026-1337 | Neo4j 安全漏洞 — Enterprise Edition | 6.1AI | Medium AI | 2026-02-06 |
| CVE-2025-66577 | cpp-httplib 安全漏洞 — cpp-httplib | 5.3 | Medium | 2025-12-05 |
| CVE-2025-20384 | Splunk Cloud Platform和Splunk Enterprise 安全漏洞 — Splunk Enterprise | 5.3 | Medium | 2025-12-03 |
| CVE-2025-36159 | IBM Concert 安全漏洞 — Concert | 6.2 | Medium | 2025-11-20 |
| CVE-2025-11627 | WordPress plugin Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue 安全漏洞 — Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue | 6.5 | Medium | 2025-10-30 |
CWE-117（日志输出的转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 101 条 CVE 漏洞。