CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 504 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);;rm -rf /String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-6279 | WordPress plugin Avada (Fusion) Builder 注入漏洞 — Avada (Fusion) Builder | 9.8 | Critical | 2026-05-21 |
| CVE-2026-20199 | Cisco ThousandEyes Virtual Appliance 注入漏洞 — Cisco ThousandEyes Enterprise Agent | 4.7 | Medium | 2026-05-20 |
| CVE-2026-42334 | Mongoose 注入漏洞 — mongoose | 7.5 | High | 2026-05-14 |
| CVE-2026-44458 | Hono 注入漏洞 — hono | 4.3 | Medium | 2026-05-13 |
| CVE-2026-44455 | Hono 注入漏洞 — hono | 4.7 | Medium | 2026-05-13 |
| CVE-2026-42838 | Microsoft Edge 注入漏洞 — Microsoft Edge (Chromium-based) | 5.4 | Medium | 2026-05-12 |
| CVE-2026-33833 | Microsoft Azure Machine Learning 注入漏洞 — Azure Machine Learning | 8.2 | High | 2026-05-12 |
| CVE-2026-41109 | Microsoft GitHub Copilot and Visual Studio 注入漏洞 — Visual Studio Code | 8.8 | High | 2026-05-12 |
| CVE-2025-8154 | WSO2多款产品 注入漏洞 — WSO2 API Manager | 5.3 | Medium | 2026-05-11 |
| CVE-2025-67486 | Dolibarr 注入漏洞 — dolibarr | 7.2AI | High AI | 2026-05-08 |
| CVE-2026-26164 | Microsoft 365 Copilot BizChat 注入漏洞 — Microsoft 365 Copilot's Business Chat | 7.5 | High | 2026-05-07 |
| CVE-2026-7045 | dynamic-datasource-spring-boot-starter 注入漏洞 — dynamic-datasource | 6.3 | Medium | 2026-04-26 |
| CVE-2026-6994 | Envoy Proxy 注入漏洞 — Envoy | 6.3 | Medium | 2026-04-25 |
| CVE-2026-41319 | MailKit 注入漏洞 — MailKit | 6.5 | Medium | 2026-04-24 |
| CVE-2026-1089 | Fortra GoAnywhere MFT 安全漏洞 — GoAnywhere MFT | 6.5 | Medium | 2026-04-21 |
| CVE-2026-0972 | Fortra GoAnywhere MFT 安全漏洞 — GoAnywhere MFT | 5.4 | Medium | 2026-04-21 |
| CVE-2026-6599 | Langflow 安全漏洞 — langflow | 6.3 | Medium | 2026-04-20 |
| CVE-2026-5797 | WordPress plugin Quiz And Survey Master 安全漏洞 — Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker | 5.3 | Medium | 2026-04-17 |
| CVE-2026-39419 | MaxKB 安全漏洞 — MaxKB | 3.1 | Low | 2026-04-14 |
| CVE-2026-35515 | nest 注入漏洞 — nest | 6.5AI | Medium AI | 2026-04-07 |
| CVE-2026-5561 | CampCodes Complete POS Management and Inventory 安全漏洞 — Complete POS Management and Inventory System | 6.3 | Medium | 2026-04-05 |
| CVE-2026-34767 | Electron 注入漏洞 — electron | 5.9 | Medium | 2026-04-03 |
| CVE-2026-34041 | Act 注入漏洞 — act | 7.1AI | High AI | 2026-03-31 |
| CVE-2026-5002 | LocalGPT 安全漏洞 — localGPT | 7.3 | High | 2026-03-28 |
| CVE-2026-32695 | Traefik 注入漏洞 — traefik | 10.0 | - | 2026-03-27 |
| CVE-2026-33148 | Tandoor Recipes 注入漏洞 — recipes | 6.5 | Medium | 2026-03-26 |
| CVE-2026-30932 | Froxlor 注入漏洞 — froxlor | 7.5 | - | 2026-03-24 |
| CVE-2026-33475 | Langflow 操作系统命令注入漏洞 — langflow | 9.1 | Critical | 2026-03-24 |
| CVE-2026-33202 | Rails 注入漏洞 — activestorage | 8.1 | - | 2026-03-23 |
| CVE-2026-4516 | MetaGPT 安全漏洞 — MetaGPT | 6.3 | Medium | 2026-03-21 |
CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 504 条 CVE 漏洞。