CWE-470 使用外部可控制的输入来选择类或代码(不安全的反射) 类弱点 68 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-470 属于不安全反射漏洞，指程序利用外部输入通过反射机制动态选择类或方法，却未对输入进行充分校验。攻击者可构造恶意输入，诱导系统实例化非预期类或调用危险方法，从而执行任意代码或导致拒绝服务。开发者应避免直接信任外部输入，需实施严格的白名单验证机制，限制可反射的类范围，并采用安全的替代方案以消除动态加载风险。
String ctl = request.getParameter("ctl"); Worker ao = null; if (ctl.equals("Add")) { ao = new AddCommand(); } else if (ctl.equals("Modify")) { ao = new ModifyCommand(); } else { throw new UnknownActionError(); } ao.doAction(request);String ctl = request.getParameter("ctl"); Class cmdClass = Class.forName(ctl + "Command"); Worker ao = (Worker) cmdClass.newInstance(); ao.doAction(request);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-93762 | 内存查询字段名注入导致数据泄露 — Mongoid | 9.8 | Critical | 2026-09-18 |
| CVE-2026-93765 | 文档删除及进程崩溃未验证方法名漏洞 — Mongoid | 9.1 | Critical | 2026-09-18 |
| CVE-2026-10853 | IBM MQ 队列管理器远程代码执行漏洞 — MQ | 7.5 | High | 2026-09-18 |
| CVE-2026-66269 | Dell OpenManage Server Admin 11.1.0.3前不安全反射漏洞 — Dell OpenManage Server Administrator Managed Node (Patch) for Windows | 7.3 | High | 2026-09-17 |
| CVE-2026-61599 | DJdjust 未认证任意模块导入漏洞 — djust | 8.8 | High | 2026-09-16 |
| CVE-2026-86792 | Apache Kafka provider 远程代码执行漏洞 — Apache Airflow Apache Kafka provider | - | - | 2026-09-16 |
| CVE-2026-79987 | Craft CMS 代码注入漏洞 — cms | 8.8 | High | 2026-09-10 |
| CVE-2026-19032 | FasterXML jackson-databind 代码注入漏洞 — jackson-databind | 5.3 | Medium | 2026-09-01 |
| CVE-2026-82078 | PaperCut MF 代码注入漏洞 — PaperCut MF/NG | 9.4 | Critical | 2026-08-28 |
| CVE-2026-54614 | CakePHP DebugKit 代码注入漏洞 — debug_kit | 4.3 | Medium | 2026-08-26 |
| CVE-2026-79784 | Gemelo AI Vocos 代码注入漏洞 — vocos | 8.8 | High | 2026-08-25 |
| CVE-2026-63337 | RabbitMQ rabbitmq-java-client 代码注入漏洞 — rabbitmq-java-client | 7.5 | High | 2026-08-18 |
| CVE-2026-19135 | OpenNMS 代码注入漏洞 — Meridian | 5.4 | Medium | 2026-08-13 |
| CVE-2026-17593 | Sonatype Nexus Repository Manager 代码注入漏洞 — Nexus Repository | 7.2 | High | 2026-08-07 |
| CVE-2026-64663 | Statamic CMS 代码注入漏洞 — cms | 6.5 | Medium | 2026-08-06 |
| CVE-2026-8400 | IBM Websphere Application Server 代码注入漏洞 — WebSphere Application Server | 8.1 | High | 2026-08-05 |
| CVE-2026-6020 | WordPress ShopLentor 代码注入漏洞 — ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | 7.2 | High | 2026-08-05 |
| CVE-2026-53666 | remix-run react-router 代码注入漏洞 — react-router | 6.1 | Medium | 2026-07-27 |
| CVE-2026-63317 | Apache OpenNLP 代码注入漏洞 — Apache OpenNLP | - | - | 2026-07-24 |
| CVE-2026-65608 | Grav 代码注入漏洞 — grav | 8.8 | High | 2026-07-23 |
| CVE-2026-13187 | Progress Software Progress Telerik UI for AJAX 代码注入漏洞 — Telerik UI for ASP.NET AJAX | 8.1 | High | 2026-07-22 |
| CVE-2026-13181 | Progress Software Progress Telerik UI for AJAX 代码注入漏洞 — Telerik UI for ASP.NET AJAX | 8.1 | High | 2026-07-22 |
| CVE-2026-44174 | Kirby 代码注入漏洞 — kirby | - | - | 2026-07-16 |
| CVE-2026-58659 | Lightning AI PyTorch Lightning 代码注入漏洞 — pytorch-lightning | 7.8 | High | 2026-07-15 |
| CVE-2026-44795 | Spinnaker 代码注入漏洞 — spinnaker | 8.8 | High | 2026-07-10 |
| CVE-2026-40008 | Apache IoTDB 代码注入漏洞 — Apache IoTDB | - | - | 2026-07-10 |
| CVE-2026-24246 | NVIDIA Megatron Bridge 代码注入漏洞 — Megatron-Bridge | 7.8 | High | 2026-07-01 |
| CVE-2026-13772 | IBM WebSphere eXtreme Scale 代码注入漏洞 — WebSphere Extreme Scale | 7.5 | High | 2026-06-30 |
| CVE-2026-48517 | MessagePack-CSharp 代码注入漏洞 — MessagePack-CSharp | - | - | 2026-06-22 |
| CVE-2026-49287 | Statamic CMS 代码注入漏洞 — cms | 7.4 | High | 2026-06-19 |
CWE-470（使用外部可控制的输入来选择类或代码(不安全的反射)） 是常见的弱点类别，本平台收录该类弱点关联的 68 条 CVE 漏洞。