CWE-77 在命令中使用的特殊元素转义处理不恰当(命令注入) 类弱点 1386 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-77即命令注入，属于输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，篡改后端系统命令，从而执行任意指令或获取敏感数据。开发者应避免直接拼接用户输入，需采用白名单过滤、参数化调用或安全API替代系统命令执行，确保输入被严格限制在预期范围内，从源头阻断注入风险。
prompt = "Explain the difference between {} and {}".format(arg1, arg2) result = invokeChatbot(prompt) resultHTML = encodeForHTML(result) print resultHTMLExplain the difference between CWE-77 and CWE-78my $arg = GetArgument("filename"); do_listing($arg); sub do_listing { my($fname) = @_; if (! validate_name($fname)) { print "Error: name is not well-formed!\n"; return; } # build command my $cmd = "/bin/ls -l $fname"; system($cmd); } sub validate_name { my($name) = @_; if ($name =~ /^[\w\-]+$/) { return(1); } else { return(0); } }if ($name =~ /^\w[\w\-]+$/) ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-28135 | PHOENIX CONTACT CHARX SEC-3000 输入验证错误漏洞 — CHARX SEC-3000 | 5.0 | Medium | 2024-05-14 |
| CVE-2024-4712 | PaperCut NG/MF 后置链接漏洞 — PaperCut NG, PaperCut MF | 7.8 | High | 2024-05-14 |
| CVE-2024-29895 | Cacti 安全漏洞 — cacti | 10.0 | Critical | 2024-05-13 |
| CVE-2024-34352 | 1Panel 命令注入漏洞 — 1Panel | 6.5 | Medium | 2024-05-09 |
| CVE-2024-34347 | Hoppscotch 安全漏洞 — hoppscotch | 8.4 | High | 2024-05-08 |
| CVE-2023-1000 | 编号已被CVE保留 — dcnnt-py | 6.3 | Medium | 2024-04-27 |
| CVE-2024-32884 | gitoxide 安全漏洞 — gitoxide | 6.4 | Medium | 2024-04-26 |
| CVE-2024-32766 | QNAP多款产品 命令注入漏洞 — QTS | 10.0 | Critical | 2024-04-26 |
| CVE-2024-3154 | CRI-O 命令注入漏洞 | 7.2 | High | 2024-04-26 |
| CVE-2023-40146 | Peplink Smart Reader 命令注入漏洞 — Smart Reader | 6.8 | Medium | 2024-04-17 |
| CVE-2024-3908 | Tenda AC500 命令注入漏洞 — AC500 | 6.3 | Medium | 2024-04-17 |
| CVE-2024-32022 | Kohya_ss 安全漏洞 — kohya_ss | 9.1 | Critical | 2024-04-16 |
| CVE-2024-32027 | Kohya_ss 安全漏洞 — kohya_ss | 9.1 | Critical | 2024-04-16 |
| CVE-2024-32026 | Kohya_ss 安全漏洞 — kohya_ss | 9.1 | Critical | 2024-04-16 |
| CVE-2024-32025 | Kohya_ss 安全漏洞 — kohya_ss | 9.1 | Critical | 2024-04-16 |
| CVE-2024-3871 | Delta Electronics DVW-W02W2-E2 安全漏洞 — DVW-W02W2-E2 | 9.8 | Critical | 2024-04-16 |
| CVE-2024-3271 | LlamaIndex 命令注入漏洞 — run-llama/llama_index | 9.8 | - | 2024-04-16 |
| CVE-2024-30220 | Planex MZK-MF300N 安全漏洞 — MZK-MF300N | 8.8 | High | 2024-04-15 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS 命令注入漏洞 — PAN-OS | 10.0 | Critical | 2024-04-12 |
| CVE-2023-6999 | WordPress Plugin Pods 安全漏洞 — Pods – Custom Content Types and Fields | 8.8 | High | 2024-04-09 |
| CVE-2024-21322 | Microsoft Defender 安全漏洞 — Microsoft Defender for IoT | 7.2 | High | 2024-04-09 |
| CVE-2024-3273 | D-Link DNS-320 命令注入漏洞 — DNS-320L | 7.3 | High | 2024-04-04 |
| CVE-2024-2947 | Cockpit 命令注入漏洞 | 7.3 | High | 2024-03-28 |
| CVE-2024-3009 | Tenda FH1205 命令注入漏洞 — FH1205 | 6.3 | Medium | 2024-03-27 |
| CVE-2024-2991 | Tenda FH1203 命令注入漏洞 — FH1203 | 6.3 | Medium | 2024-03-27 |
| CVE-2024-1540 | Gradio 命令注入漏洞 — gradio-app/gradio | 7.5 | - | 2024-03-27 |
| CVE-2024-2982 | Tenda FH1202 命令注入漏洞 — FH1202 | 5.5 | Medium | 2024-03-27 |
| CVE-2024-24897 | A-Tune 安全漏洞 — A-Tune-Collector | 8.1 | High | 2024-03-25 |
| CVE-2024-2642 | Ruijie Networks RG-NBS2009G-P 命令注入漏洞 — RG-NBS2009G-P | 7.3 | High | 2024-03-19 |
| CVE-2023-41334 | Astropy 安全漏洞 — astropy | 8.4 | High | 2024-03-18 |
CWE-77（在命令中使用的特殊元素转义处理不恰当(命令注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1386 条 CVE 漏洞。