CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 504 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-91915 | Dell OpenManage 4.8.0 前版本注入漏洞 — OpenManage Enterprise | 6.8 | Medium | 2026-10-30 |
| CVE-2026-89435 | Formidable Forms 6.35 认证任意插件安装漏洞 — Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder | 8.8 | High | 2026-10-30 |
| CVE-2026-54453 | OpenCATS 认证远程代码执行漏洞 — OpenCATS | 7.2 | High | 2026-10-28 |
| CVE-2026-118258 | i18next-http-backend 查询参数注入漏洞 — i18next-http-backend | 3.7 | Low | 2026-10-28 |
| CVE-2026-103405 | Session Smart 系列 HTTP 响应拆分漏洞 — Session Smart Router | 5.8 | Medium | 2026-10-28 |
| CVE-2026-103400 | Session 路由服务：目录名致服务清理时任意卸载文件系统 — Session Smart Router | 5.5 | Medium | 2026-10-28 |
| CVE-2026-115730 | i18next-http-backend 4.0.2 命名空间协议相对 URL 注入漏洞 — i18next-http-backend | 3.1 | Low | 2026-10-23 |
| CVE-2026-114655 | libmongocrypt 因 KMS 请求注入漏洞 — libmongocrypt | 5.9 | Medium | 2026-10-22 |
| CVE-2026-76473 | 思科统一通信产品资源生命周期控制不当漏洞 — Cisco Emergency Responder | 9.8 | Critical | 2026-10-21 |
| CVE-2026-112183 | MISP 事件预览远程标签颜色 CSS 注入漏洞 — MISP | 4.8 | Medium | 2026-10-19 |
| CVE-2026-111223 | Netgate pfSense CE 2.7.0至2.9.0 IPSec移动登录横幅命令注入漏洞 — pfSense CE | 7.2 | High | 2026-10-15 |
| CVE-2026-55453 | CUPS IPP后端状态行注入可更新队列PPD并导致RCE — cups | 3.3 | Low | 2026-10-15 |
| CVE-2026-108116 | Kendo UI for jQuery MDX与SOAP注入漏洞 — Kendo UI for jQuery | 7.5 | High | 2026-10-15 |
| CVE-2026-76182 | Jetty TryPathsHandler/Filter路径解析逻辑漏洞 — Eclipse Jetty | 6.9 | Medium | 2026-10-15 |
| CVE-2026-81534 | WooCommerce Email Customizer 3.9.5 远程代码执行漏洞 — Email Customizer for WooCommerce (Pro) | 8.8 | High | 2026-10-15 |
| CVE-2026-88094 | Azure存储库特权提升漏洞 — azure-storage-blob-batch | 8.1 | High | 2026-10-13 |
| CVE-2026-109961 | Froxlor 0.10.0-2.3.14 FTPS成员添加换行注入漏洞 — froxlor | 8.5 | High | 2026-10-13 |
| CVE-2026-109275 | ImageMagick 代码注入漏洞（MVG解码器） — ImageMagick | 4.8 | Medium | 2026-10-12 |
| CVE-2026-102291 | Kirki <= 6.3.1 用户任意短代码执行漏洞 — Kirki – Freeform Page Builder, Website Builder & Customizer | 5.4 | Medium | 2026-10-10 |
| CVE-2026-76472 | Cisco Meraki 2026年10月安全更新 特殊元素处理不当漏洞 — Cisco Campus Gateway Software | 8.8 | High | 2026-10-07 |
| CVE-2026-102156 | 请提供漏洞标题内容，以便翻译 — CloudVision CUE | 6.8 | Medium | 2026-10-06 |
| CVE-2026-102158 | Apache Log4j 安全漏洞 — CloudVision CUE | 6.5 | Medium | 2026-10-06 |
| CVE-2026-105800 | i18next-http-backend 不完整URL验证致SSRF漏洞 — i18next-http-backend | 3.7 | Low | 2026-10-06 |
| CVE-2026-101904 | Axios 继承头导致的头部注入漏洞 — axios | 6.9 | Medium | 2026-09-28 |
| CVE-2026-101900 | Axios Fetch 适配器 FormData 头注入漏洞 — axios | 6.9 | Medium | 2026-09-28 |
| CVE-2026-95832 | Kitty终端反射命令执行漏洞 — kitty | 9.3 | Critical | 2026-09-25 |
| CVE-2026-61732 | ChatML特殊令牌伪造导致LLM上下文注入漏洞 — Decepticon | 10.0 | Critical | 2026-09-24 |
| CVE-2026-19179 | IBM Financial Transaction Manager 多漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 8.2 | High | 2026-09-23 |
| CVE-2026-18875 | IBM Financial Transaction Manager 多重漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 7.3 | High | 2026-09-23 |
| CVE-2026-87909 | WP Photo Album Plus 9.2.09.002 远程代码执行漏洞 — WP Photo Album Plus | 7.5 | High | 2026-09-19 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 504 条 CVE 漏洞。