CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 504 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-32756 | ManageIQ MiqExpression 代码注入漏洞 — manageiq | 8.8 | High | 2021-07-21 |
| CVE-2021-29084 | Synology DiskStation DS418play 注入漏洞 — DiskStation Manager (DSM) | 7.5 | High | 2021-06-23 |
| CVE-2021-29085 | Synology DiskStation Manager 注入漏洞 — DiskStation Manager (DSM) | 8.6 | High | 2021-06-23 |
| CVE-2021-32647 | Emissary 注入漏洞 — emissary | 8.0 | High | 2021-05-28 |
| CVE-2021-32622 | Travis Ralston matrix-react-sdk 代码问题漏洞 — matrix-react-sdk | 4.2 | Medium | 2021-05-17 |
| CVE-2021-29502 | Laggrons-Dumb-Cogs 代码注入漏洞 — Laggrons-Dumb-Cogs | 7.3 | High | 2021-05-10 |
| CVE-2021-29501 | Red Discord Bot 命令注入漏洞 — Dav-Cogs | 8.1 | High | 2021-05-10 |
| CVE-2021-21420 | vscode-stripe 注入漏洞 — vscode-stripe | 7.5 | High | 2021-04-01 |
| CVE-2021-21333 | Matrix Synapse 跨站脚本漏洞 — synapse | 6.1 | Medium | 2021-03-26 |
| CVE-2021-24144 | Wordpress Contact Form 7 Database Addon 注入漏洞 — Contact Form 7 Database Addon | 8.8 | - | 2021-03-18 |
| CVE-2021-21381 | Flatpak 注入漏洞 — flatpak | 7.1 | High | 2021-03-11 |
| CVE-2021-21313 | GLPI 跨站脚本漏洞 — glpi | 4.9 | Medium | 2021-03-03 |
| CVE-2021-21353 | Pug 注入漏洞 — pug | 6.8 | Medium | 2021-03-03 |
| CVE-2021-21316 | Less-openui5 注入漏洞 — less-openui5 | 6.3 | Medium | 2021-02-16 |
| CVE-2021-21305 | Mshibuya CarrierWave 代码代码注入漏洞 — carrierwave | 7.4 | High | 2021-02-08 |
| CVE-2021-21303 | Helm 注入漏洞 — helm | 5.9 | Medium | 2021-02-05 |
| CVE-2021-21277 | Peerigon angular-expressions 代码注入漏洞 — angular-expressions | 8.5 | High | 2021-02-01 |
| CVE-2021-21278 | RSSHub 注入漏洞 — RSSHub | 8.6 | High | 2021-01-26 |
| CVE-2021-21263 | Laravel Framework SQL注入漏洞 — framework | 7.2 | High | 2021-01-19 |
| CVE-2021-21247 | Theonedev Onedev 代码问题漏洞 — onedev | 9.6 | Critical | 2021-01-15 |
| CVE-2021-21249 | Theonedev Onedev 代码问题漏洞 — onedev | 9.6 | Critical | 2021-01-15 |
| CVE-2021-21248 | Theonedev Onedev 代码注入漏洞 — onedev | 9.6 | Critical | 2021-01-15 |
| CVE-2021-21242 | Theonedev Onedev 代码问题漏洞 — onedev | 10.0 | Critical | 2021-01-15 |
| CVE-2021-21243 | Theonedev Onedev 代码问题漏洞 — onedev | 10.0 | Critical | 2021-01-15 |
| CVE-2021-21244 | Theonedev Onedev 代码代码注入漏洞 — onedev | 10.0 | Critical | 2021-01-15 |
| CVE-2021-21261 | Flatpak 注入漏洞 — flatpak | 7.3 | High | 2021-01-14 |
| CVE-2020-26298 | Vicent Martí Redcarpet 注入漏洞 — redcarpet | 6.8 | Medium | 2021-01-11 |
| CVE-2020-27260 | Innokas Medical Innokas Yhtyma Oy Vital Signs Monitor 注入漏洞 — BIGCOMPANYSOFT SOFTWARE PRODUCT | 5.3 | - | 2021-01-08 |
| CVE-2020-26293 | Mganss HtmlSanitizer 跨站脚本漏洞 — HtmlSanitizer | 6.1 | Medium | 2021-01-04 |
| CVE-2020-26282 | BrowserUp Proxy 注入漏洞 — browserup-proxy | 10.0 | Critical | 2020-12-24 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 504 条 CVE 漏洞。