CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 453 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-36618 | Node WHOIS 安全漏洞 — node-whois | 6.3 | Medium | 2022-12-19 |
| CVE-2021-4245 | chbrown rfc6902 安全漏洞 — rfc6902 | 5.5 | Medium | 2022-12-15 |
| CVE-2022-46265 | Siemens Polarion 注入漏洞 — Polarion ALM | 5.4 | Medium | 2022-12-13 |
| CVE-2022-4170 | rxvt-unicode 安全漏洞 — rxvt-unicode | 9.8 | - | 2022-12-09 |
| CVE-2022-46169 | Cacti 命令注入漏洞 — cacti | 9.8 | Critical | 2022-12-05 |
| CVE-2022-46162 | Discourse 跨站脚本漏洞 — discourse-bbcode | 8.8 | High | 2022-11-30 |
| CVE-2022-41934 | XWiki Platform 注入漏洞 — xwiki-platform | 9.9 | Critical | 2022-11-23 |
| CVE-2022-4064 | Dalli 注入漏洞 — Dalli | 3.7 | Low | 2022-11-19 |
| CVE-2022-41878 | Parse Server 安全漏洞 — parse-server | 7.2 | High | 2022-11-10 |
| CVE-2022-39382 | Keystone 注入漏洞 — keystone | 9.8 | Critical | 2022-11-03 |
| CVE-2022-31777 | Apache Spark 注入漏洞 — Apache Spark | 5.4 | - | 2022-11-01 |
| CVE-2021-38395 | Honeywell Experion PKS和Honeywell Ace Controllers 注入漏洞 — Experion PKS | 9.1 | Critical | 2022-10-28 |
| CVE-2022-40248 | VINCE 跨站脚本漏洞 — VINCE - The Vulnerability Information and Coordination Environment | 5.4 | - | 2022-10-10 |
| CVE-2022-40257 | VINCE 跨站脚本漏洞 — VINCE - The Vulnerability Information and Coordination Environment | 5.4 | - | 2022-10-10 |
| CVE-2022-39265 | MyBB 注入漏洞 — mybb | 7.2 | High | 2022-10-06 |
| CVE-2022-39217 | GitHub Advanced Security to CSV 安全漏洞 — ghas-to-csv | 5.8 | Medium | 2022-09-16 |
| CVE-2022-38191 | Esri Portal For ArcGis 跨站脚本漏洞 — Portal for ArcGIS | 6.1 | Medium | 2022-08-15 |
| CVE-2022-36323 | Siemens SCALANCE 安全漏洞 — RUGGEDCOM RM1224 LTE(4G) EU | 9.1 | Critical | 2022-08-10 |
| CVE-2022-35735 | F5 BIG-IP 注入漏洞 — BIG-IP | 7.2 | High | 2022-08-04 |
| CVE-2022-31179 | shescape 注入漏洞 — shescape | 8.1 | High | 2022-08-01 |
| CVE-2022-31180 | Shescape 安全漏洞 — shescape | 9.8 | Critical | 2022-08-01 |
| CVE-2016-15004 | Revmakx InfiniteWP Client Plugin 注入漏洞 — InfiniteWP Client Plugin | 7.3 | High | 2022-07-23 |
| CVE-2022-31593 | SAP Business One client 注入漏洞 — SAP Business One | 8.8 | - | 2022-07-12 |
| CVE-2022-34466 | Siemens Mendix Applications using Mendix 9 注入漏洞 — Mendix Applications using Mendix 9 | 7.5 | - | 2022-07-12 |
| CVE-2022-31126 | Roxy-WI 注入漏洞 — roxy-wi | 10.0 | Critical | 2022-07-06 |
| CVE-2022-31014 | Nextcloud 注入漏洞 — security-advisories | 5.4 | Medium | 2022-07-05 |
| CVE-2022-31108 | Mermaid 跨站脚本漏洞 — mermaid | 4.1 | Medium | 2022-06-28 |
| CVE-2022-31086 | LDAP Account Manager 代码问题漏洞 — lam | 8.8 | - | 2022-06-27 |
| CVE-2022-31087 | LDAP Account Manager 注入漏洞 — lam | 7.8 | - | 2022-06-27 |
| CVE-2022-31088 | LDAP Account Manager 注入漏洞 — lam | 5.3 | - | 2022-06-27 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 453 条 CVE 漏洞。