CWE-644 对HTTP头部进行脚本语法转义处理不恰当 类弱点 55 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-644属于HTTP头注入漏洞，指产品未正确净化HTTP头中的脚本语法。攻击者常通过构造恶意HTTP头，利用浏览器组件（如Flash）执行跨站脚本攻击，窃取用户数据或劫持会话。开发者应避免将用户可控数据直接写入HTTP头，需对输入进行严格过滤与编码，确保特殊字符被正确转义，从而阻断恶意脚本的执行路径，保障应用安全。
response.addHeader(HEADER_NAME, untrustedRawInputData);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-67179 | Genkit 跨站脚本漏洞 — genkit | 7.8 | High | 2026-08-11 |
| CVE-2026-66778 | SAP Approuter 跨站脚本漏洞 — SAP Business AI Platform (Approuter) | 5.3 | Medium | 2026-08-11 |
| CVE-2026-72574 | picocms Pico 跨站脚本漏洞 — Pico | 6.1 | Medium | 2026-08-10 |
| CVE-2026-0516 | SonicWALL SonicOS 跨站脚本漏洞 — SonicOS | - | - | 2026-08-05 |
| CVE-2026-48061 | Litestar 跨站脚本漏洞 — litestar | 5.9 | Medium | 2026-08-03 |
| CVE-2026-21762 | HCL DevOps Loop 跨站脚本漏洞 — DevOps Loop | 3.7 | Low | 2026-07-17 |
| CVE-2026-54477 | Gardyn Home Firmware 跨站脚本漏洞 — Gardyn Home Firmware | 5.4 | Medium | 2026-07-02 |
| CVE-2024-51454 | IBM Engineering Workflow Management 跨站脚本漏洞 — Engineering Workflow Management | 6.5 | Medium | 2026-06-22 |
| CVE-2026-10836 | Lito Password Manager 跨站脚本漏洞 — Password Manager | - | - | 2026-06-17 |
| CVE-2026-4096 | IBM DevOps Plan 安全漏洞 — DevOps Plan | 6.5 | Medium | 2026-06-11 |
| CVE-2026-33805 | fastify/reply-from和fastify/http-proxy 安全漏洞 — @fastify/reply-from | 7.5 | - | 2026-04-15 |
| CVE-2025-66485 | IBM Aspera Shares 安全漏洞 — Aspera Shares | 5.4 | Medium | 2026-04-01 |
| CVE-2026-33149 | Tandoor Recipes 安全漏洞 — recipes | 8.1 | High | 2026-03-26 |
| CVE-2025-14807 | IBM InfoSphere Information Server 安全漏洞 — InfoSphere Information Server | 6.5 | Medium | 2026-03-25 |
| CVE-2025-13213 | IBM Aspera Orchestrator 安全漏洞 — Aspera Orchestrator | 5.4 | Medium | 2026-03-10 |
| CVE-2025-36227 | IBM Aspera Faspex 安全漏洞 — Aspera Faspex 5 | 5.4 | Medium | 2026-03-10 |
| CVE-2026-1698 | PcVue 安全漏洞 — PcVue | 6.5AI | Medium AI | 2026-02-26 |
| CVE-2025-27901 | IBM DB2 Recovery Expert 安全漏洞 — DB2 Recovery Expert for LUW | 6.5 | Medium | 2026-02-17 |
| CVE-2026-26234 | JUNG Smart Visu Server 安全漏洞 — JUNG Smart Visu Server | 8.8 | High | 2026-02-12 |
| CVE-2024-51451 | IBM Concert 安全漏洞 — Concert | 6.5 | Medium | 2026-02-04 |
| CVE-2025-52660 | HCL AION 安全漏洞 — AION | 2.7 | Low | 2026-01-19 |
| CVE-2025-64425 | Coolify 安全漏洞 — coolify | 8.0 | - | 2026-01-05 |
| CVE-2025-13803 | MediaCrush 安全漏洞 — MediaCrush | 7.3 | High | 2025-12-01 |
| CVE-2025-13434 | Hush Framework 安全漏洞 — Hush Framework | 5.3 | Medium | 2025-11-20 |
| CVE-2025-36223 | IBM OpenPages 安全漏洞 — OpenPages | 5.4 | Medium | 2025-11-12 |
| CVE-2025-64484 | OAuth2-Proxy 安全漏洞 — oauth2-proxy | 8.5 | High | 2025-11-10 |
| CVE-2025-52647 | HCL BigFix WebUI 安全漏洞 — BigFix WebUI | 6.1 | Medium | 2025-10-10 |
| CVE-2024-40686 | IBM Operations Analytics-Log Analysis 安全漏洞 — SmartCloud Analytics Log Analysis | 5.4 | Medium | 2025-07-23 |
| CVE-2025-40631 | IceWarp Mail Server 安全漏洞 — Icewarp Mail Server | 6.1AI | Medium AI | 2025-05-16 |
| CVE-2025-24339 | Bosch Rexroth ctrlX OS 安全漏洞 — ctrlX OS - Device Admin | 5.0 | Medium | 2025-04-30 |
CWE-644（对HTTP头部进行脚本语法转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 55 条 CVE 漏洞。