CWE-77 在命令中使用的特殊元素转义处理不恰当(命令注入) 类弱点 1382 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-77即命令注入，属于输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，篡改后端系统命令，从而执行任意指令或获取敏感数据。开发者应避免直接拼接用户输入，需采用白名单过滤、参数化调用或安全API替代系统命令执行，确保输入被严格限制在预期范围内，从源头阻断注入风险。
prompt = "Explain the difference between {} and {}".format(arg1, arg2) result = invokeChatbot(prompt) resultHTML = encodeForHTML(result) print resultHTMLExplain the difference between CWE-77 and CWE-78my $arg = GetArgument("filename"); do_listing($arg); sub do_listing { my($fname) = @_; if (! validate_name($fname)) { print "Error: name is not well-formed!\n"; return; } # build command my $cmd = "/bin/ls -l $fname"; system($cmd); } sub validate_name { my($name) = @_; if ($name =~ /^[\w\-]+$/) { return(1); } else { return(0); } }if ($name =~ /^\w[\w\-]+$/) ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-11659 | EnGenius多款产品 安全漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11658 | EnGenius多款产品 注入漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11657 | EnGenius多款产品 注入漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11656 | EnGenius多款产品 注入漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11655 | EnGenius多款产品 注入漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11654 | EnGenius多款产品 注入漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11653 | EnGenius多款产品 注入漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11652 | EnGenius多款产品 安全漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11651 | EnGenius多款产品 安全漏洞 — ENH1350EXT | 4.7 | Medium | 2024-11-25 |
| CVE-2024-11665 | ONEKEY Platform 命令注入漏洞 — cph2_echarge_firmware | 8.8 | High | 2024-11-24 |
| CVE-2021-38116 | OpenText iManager 安全漏洞 — iManager | 8.8 | High | 2024-11-22 |
| CVE-2023-24467 | OpenText iManager 安全漏洞 — iManager | 8.8 | High | 2024-11-22 |
| CVE-2024-38644 | QNAP Systems Notes Station 安全漏洞 — Notes Station 3 | 8.8 | - | 2024-11-22 |
| CVE-2024-48860 | QNAP Systems QuRouter 安全漏洞 — QuRouter | 9.8 | - | 2024-11-22 |
| CVE-2024-48861 | QNAP Systems QuRouter 命令注入漏洞 — QuRouter | 7.8 | - | 2024-11-22 |
| CVE-2024-11320 | Pandora FMS 命令注入漏洞 — Pandora FMS | 9.8AI | Critical AI | 2024-11-21 |
| CVE-2024-45505 | Apache HertzBeat 命令注入漏洞 — Apache HertzBeat | 8.8AI | High AI | 2024-11-18 |
| CVE-2024-52308 | GitHub CLI 命令注入漏洞 — cli | 8.0 | High | 2024-11-14 |
| CVE-2024-43613 | Microsoft Azure Database for PostgreSQL 命令注入漏洞 — Azure Database for PostgreSQL Flexible Server | 7.2 | High | 2024-11-12 |
| CVE-2024-49042 | Microsoft Azure Database for PostgreSQL 命令注入漏洞 — Azure Database for PostgreSQL Flexible Server | 7.2 | High | 2024-11-12 |
| CVE-2024-49026 | Microsoft Excel 命令注入漏洞 — Microsoft Office 2019 | 7.8 | High | 2024-11-12 |
| CVE-2024-49557 | Dell SmartFabric OS10 命令注入漏洞 — SmartFabric OS10 Software | 7.8 | High | 2024-11-12 |
| CVE-2024-49560 | Dell SmartFabric OS10 命令注入漏洞 — SmartFabric OS10 Software | 7.8 | High | 2024-11-12 |
| CVE-2024-50591 | HASOMED Elefant 安全漏洞 — Elefant Software Updater | 6.7 | - | 2024-11-08 |
| CVE-2024-51736 | Symfony 命令注入漏洞 — symfony | - | - | 2024-11-06 |
| CVE-2024-20418 | Cisco Unified Industrial Wireless Software 命令注入漏洞 — Cisco Aironet Access Point Software (IOS XE Controller) | 10.0 | Critical | 2024-11-06 |
| CVE-2024-9579 | HP TC8 安全漏洞 — Certain Poly Video Conference Devices | 7.5 | High | 2024-11-05 |
| CVE-2024-10697 | Tenda AC6 安全漏洞 — AC6 | 6.3 | Medium | 2024-11-02 |
| CVE-2024-10435 | DiDi Super-Jacoco 命令注入漏洞 — Super-Jacoco | 6.3 | Medium | 2024-10-28 |
| CVE-2024-10429 | WAVLINK多款产品 命令注入漏洞 — WN530H4 | 7.2 | High | 2024-10-27 |
CWE-77（在命令中使用的特殊元素转义处理不恰当(命令注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1382 条 CVE 漏洞。