Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 504

504 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
Confidentiality Read Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access Control Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Other Alter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, Other Other
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation Hide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
Requirements Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID Title CVSS Severity Published
CVE-2024-48927 Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice — Umbraco-CMS 4.6 Medium 2024-10-22
CVE-2024-47764 cookie accepts cookie name, path, and domain with out of bounds characters — cookie 5.3 - 2024-10-04
CVE-2024-47180 Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges — shields 8.8 High 2024-09-26
CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk — dataease 9.8 Critical 2024-09-23
CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian — sofa-hessian 9.8 Critical 2024-09-19
CVE-2024-46986 Arbitrary file write leading to RCE in Camaleon CMS — camaleon-cms 10.0 Critical 2024-09-18
CVE-2024-6702 Pegasystem PEGA Platform 安全漏洞 — Pega Infinity 5.2 Medium 2024-09-12
CVE-2024-8367 HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection — Probate Back Office 3.5 Low 2024-09-01
CVE-2024-43782 openedx-translations's Atlas translations for Open edX missing validation — openedx-translations 7.7 High 2024-08-23
CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps — flatpak 10.0 Critical 2024-08-15
CVE-2024-42489 Pro Macros Remote Code Execution via Viewpdf and similar macros — xwiki-pro-macros 10.0 Critical 2024-08-12
CVE-2024-6331 Injection by Prompt Injection in stitionai/devika — stitionai/devika 7.5 High 2024-08-04
CVE-2024-41127 Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access. — monkeytype 8.4 High 2024-08-02
CVE-2024-39320 Discourse allows iframe injection though default site setting — discourse 6.1 Medium 2024-07-30
CVE-2024-26020 Ankitects Anki 注入漏洞 — Anki 9.6 Critical 2024-07-22
CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker — woodpecker 7.5 High 2024-07-19
CVE-2024-41121 Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker — woodpecker 8.8 High 2024-07-19
CVE-2024-39906 Remote code execution in Haven IndieAuthClient (GHSL-2024-093) — haven 8.4 High 2024-07-19
CVE-2024-41111 BishopFox Sliver Authenticated Remote Code Execution — sliver 7.2 High 2024-07-18
CVE-2024-20429 Cisco Secure Email 安全漏洞 — Cisco Secure Email 6.5 Medium 2024-07-17
CVE-2024-40637 Implicit override for built-in materializations from installed packages in dbt-core — dbt-core 4.2 Medium 2024-07-16
CVE-2024-38700 WordPress WPCS – WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution vulnerability — WPCS 6.5 Medium 2024-07-12
CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection — Apache Wicket 9.8AI Critical AI 2024-07-12
CVE-2024-37442 WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerability — Photo Gallery by Ays 3.8 Low 2024-07-09
CVE-2024-37253 WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability — WP Directory Kit 2.7 Low 2024-07-09
CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability — WooCommerce 3.5 Low 2024-07-09
CVE-2024-6470 playSMS Template injection — playSMS 2.7 Low 2024-07-03
CVE-2024-6469 playSMS Template injection — playSMS 2.7 Low 2024-07-03
CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822 — CocoaPods 10.0 Critical 2024-07-01
CVE-2024-36420 GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file — Flowise 7.5 High 2024-07-01

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 504 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.