CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 453 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-36531 | SevOne Network Management System 安全漏洞 — Network Management System | 6.3 | Medium | 2022-06-03 |
| CVE-2022-30991 | TIETEN Acronis Cyber Protect 跨站脚本漏洞 — Acronis Cyber Protect 15 | 7.2 | - | 2022-05-18 |
| CVE-2022-23068 | ToolJet 跨站脚本漏洞 — ToolJet | 5.4 | Medium | 2022-05-18 |
| CVE-2022-29171 | Sourcegraph 代码注入漏洞 — sourcegraph | 6.6 | Medium | 2022-05-05 |
| CVE-2022-29166 | Matrix matrix-appservice-irc 注入漏洞 — matrix-appservice-irc | 8.0 | High | 2022-05-05 |
| CVE-2022-23064 | Snipe-IT 注入漏洞 — snipe-it | 8.8 | High | 2022-05-02 |
| CVE-2022-29816 | Jetbrains JetBrains IntelliJ IDEA 跨站脚本漏洞 — IntelliJ IDEA | 2.8 | Low | 2022-04-28 |
| CVE-2022-24888 | Nextcloud 安全漏洞 — security-advisories | 4.3 | Medium | 2022-04-27 |
| CVE-2022-20693 | Cisco IOS XE Software 操作系统命令注入漏洞 — Cisco IOS XE Software | 4.7 | Medium | 2022-04-15 |
| CVE-2022-24838 | Nextcloud 注入漏洞 — security-advisories | 5.3 | Medium | 2022-04-11 |
| CVE-2022-24832 | GoCD 注入漏洞 — gocd | 8.2 | High | 2022-04-11 |
| CVE-2022-1074 | TEM FLEX-1085 跨站脚本漏洞 — FLEX-1085 | 4.3 | Medium | 2022-03-29 |
| CVE-2022-20001 | Github fish 注入漏洞 — fish-shell | 7.8 | High | 2022-03-14 |
| CVE-2022-24760 | Parse Server 注入漏洞 — parse-server | 10.0 | Critical | 2022-03-11 |
| CVE-2022-21705 | Octobercms 安全漏洞 — october | 7.2 | High | 2022-02-23 |
| CVE-2022-23616 | Xwiki Platform 注入漏洞 — xwiki-platform | 8.8 | High | 2022-02-09 |
| CVE-2022-0391 | Python 注入漏洞 — python | 7.5 | - | 2022-02-09 |
| CVE-2021-43929 | Synology DiskStation Manager 跨站脚本漏洞 — DiskStation Manager (DSM) | 6.5 | Medium | 2022-02-07 |
| CVE-2022-23614 | Sensio Labs Twig 代码代码注入漏洞 — Twig | 8.8 | High | 2022-02-04 |
| CVE-2021-32649 | October CMS 代码代码注入漏洞 — october | 8.8 | High | 2022-01-14 |
| CVE-2021-32650 | October CMS 代码注入漏洞 — october | 8.8 | High | 2022-01-14 |
| CVE-2021-29454 | Smarty 注入漏洞 — smarty | 8.1 | High | 2022-01-10 |
| CVE-2022-21663 | WordPress 代码问题漏洞 — wordpress-develop | 6.6 | Medium | 2022-01-06 |
| CVE-2021-43852 | OroPlatform 注入漏洞 — platform | 8.8 | High | 2022-01-04 |
| CVE-2021-25994 | Userfrosting 注入漏洞 — userfrosting | 8.8 | High | 2022-01-03 |
| CVE-2021-43837 | vault-cli 代码注入漏洞 — vault-cli | 8.4 | High | 2021-12-16 |
| CVE-2021-41276 | Tuleap 注入漏洞 — tuleap | 6.7 | Medium | 2021-12-15 |
| CVE-2021-43818 | lxml 注入漏洞 — lxml | 8.2 | High | 2021-12-13 |
| CVE-2021-36313 | Dell EMC CloudLink 操作系统命令注入漏洞 — CloudLink | 9.1 | Critical | 2021-11-23 |
| CVE-2021-25980 | Talkyard 注入漏洞 — talkyard | 8.8 | High | 2021-11-11 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 453 条 CVE 漏洞。