Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 504

504 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
Confidentiality Read Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access Control Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Other Alter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, Other Other
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation Hide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
Requirements Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID Title CVSS Severity Published
CVE-2026-91915 Dell OpenManage 4.8.0 前版本注入漏洞 — OpenManage Enterprise 6.8 Medium 2026-10-30
CVE-2026-89435 Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter — Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder 8.8 High 2026-10-30
CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) — OpenCATS 7.2 High 2026-10-28
CVE-2026-118258 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string — i18next-http-backend 3.7 Low 2026-10-28
CVE-2026-103405 Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting — Session Smart Router 5.8 Medium 2026-10-28
CVE-2026-103400 Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup — Session Smart Router 5.5 Medium 2026-10-28
CVE-2026-115730 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl — i18next-http-backend 3.1 Low 2026-10-23
CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt — libmongocrypt 5.9 Medium 2026-10-22
CVE-2026-76473 Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. — Cisco Emergency Responder 9.8 Critical 2026-10-21
CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview — MISP 4.8 Medium 2026-10-19
CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner — pfSense CE 7.2 High 2026-10-15
CVE-2026-55453 CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip — cups 3.3 Low 2026-10-15
CVE-2026-108116 MDX and SOAP Injection in Kendo UI for jQuery — Kendo UI for jQuery 7.5 High 2026-10-15
CVE-2026-76182 Jetty TryPathsHandler/Filter路径解析逻辑漏洞 — Eclipse Jetty 6.9 Medium 2026-10-15
CVE-2026-81534 Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter — Email Customizer for WooCommerce (Pro) 8.8 High 2026-10-15
CVE-2026-88094 Azure Storage Library Elevation of Privilege Vulnerability — azure-storage-blob-batch 8.1 High 2026-10-13
CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members — froxlor 8.5 High 2026-10-13
CVE-2026-109275 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder — ImageMagick 4.8 Medium 2026-10-12
CVE-2026-102291 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' — Kirki – Freeform Page Builder, Website Builder & Customizer 5.4 Medium 2026-10-10
CVE-2026-76472 Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities — Cisco Campus Gateway Software 8.8 High 2026-10-07
CVE-2026-102156 Security Advisory 0191 — CloudVision CUE 6.8 Medium 2026-10-06
CVE-2026-102158 Security Advisory 0190 — CloudVision CUE 6.5 Medium 2026-10-06
CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF — i18next-http-backend 3.7 Low 2026-10-06
CVE-2026-101904 Axios: Header Injection via Inherited headers After Minimal Interceptor — axios 6.9 Medium 2026-09-28
CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders — axios 6.9 Medium 2026-09-28
CVE-2026-95832 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell — kitty 9.3 Critical 2026-09-25
CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context — Decepticon 10.0 Critical 2026-09-24
CVE-2026-19179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities — Financial Transaction Manager (FTM) for RedHat OpenShift 8.2 High 2026-09-23
CVE-2026-18875 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities — Financial Transaction Manager (FTM) for RedHat OpenShift 7.3 High 2026-09-23
CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection — WP Photo Album Plus 7.5 High 2026-09-19

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 504 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.