Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 504

504 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
Confidentiality Read Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access Control Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Other Alter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, Other Other
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation Hide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
Requirements Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID Title CVSS Severity Published
CVE-2025-14674 aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injection — snail-job 6.3 Medium 2025-12-14
CVE-2024-56840 Siemens RUGGEDCOM ROX II 注入漏洞 — RUGGEDCOM ROX MX5000 7.2 High 2025-12-09
CVE-2024-56839 Siemens RUGGEDCOM ROX II 注入漏洞 — RUGGEDCOM ROX MX5000 7.2 High 2025-12-09
CVE-2024-56838 Siemens RUGGEDCOM ROX II 注入漏洞 — RUGGEDCOM ROX MX5000 7.2 High 2025-12-09
CVE-2024-56835 Siemens RUGGEDCOM ROX II 注入漏洞 — RUGGEDCOM ROX MX5000 8.8 High 2025-12-09
CVE-2025-66025 Caido Improperly Handles External Links in Markdown — caido 4.3 Medium 2025-11-26
CVE-2025-64428 DataEase DB2 JNDI Vulnerability — dataease 9.1 - 2025-11-20
CVE-2025-13268 Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection — dataCompare 6.3 Medium 2025-11-17
CVE-2025-64741 Zoom Workplace for Android - Improper Authorization Handling — Zoom Workplace for Android 8.1 High 2025-11-13
CVE-2025-64099 OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info — OpenAM 4.3 - 2025-11-12
CVE-2025-47286 Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality — iTop 9.1 - 2025-11-10
CVE-2025-62697 Improperly sanitized style parameter in LanguageSelector — Mediawiki - LanguageSelector Extension 9.8AI Critical AI 2025-10-20
CVE-2025-61773 pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters — pyload 8.1 High 2025-10-09
CVE-2025-11445 Kilo Code Prompt ClineProvider.ts ClineProvider injection — Kilo Code 6.3 Medium 2025-10-08
CVE-2025-7350 Rockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution Vulnerability — Stratix IOS 9.8AI Critical AI 2025-09-09
CVE-2025-6785 Tesla Model 3 Physical CAN Bus Injection — Model 3 6.1AI Medium AI 2025-09-04
CVE-2025-9797 mrvautin expressCart Edit Product edit injection — expressCart 2.4 Low 2025-09-01
CVE-2025-20265 Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability — Cisco Firepower Management Center 10.0 Critical 2025-08-14
CVE-2025-20337 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability — Cisco Identity Services Engine Software 10.0 Critical 2025-07-16
CVE-2025-20284 Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability — Cisco Identity Services Engine Software 6.5 Medium 2025-07-16
CVE-2025-20283 Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability — Cisco Identity Services Engine Software 6.5 Medium 2025-07-16
CVE-2025-40710 Host Header Injection (HHI) in the Hotspot Shield VPN client — Hotspot Shield VPN client 7.2AI High AI 2025-06-30
CVE-2025-53097 Roo Code extension vulnerable to Potential Information Leakage via JSON Schema — Roo-Code 5.9 Medium 2025-06-27
CVE-2025-20281 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability — Cisco Identity Services Engine Software 10.0 Critical 2025-06-25
CVE-2025-47867 Trend Micro Apex Central 安全漏洞 — Trend Micro Apex Central 7.5 High 2025-06-17
CVE-2025-32711 M365 Copilot Information Disclosure Vulnerability — Microsoft 365 Copilot 9.3 Critical 2025-06-11
CVE-2025-20256 Cisco Secure Network Analytics Manager Server-Side Template Injection Vulnerability — Cisco Secure Network Analytics 6.5 Medium 2025-05-21
CVE-2025-48056 Hubble CLI vulnerable to character injection — hubble 5.3 Medium 2025-05-20
CVE-2025-47948 Cocotais Bot has builtin .echo command injection — cocotais-bot 7.2 High 2025-05-17
CVE-2025-32390 EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover — espocrm 4.6AI Medium AI 2025-05-12

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 504 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.