CWE-77 在命令中使用的特殊元素转义处理不恰当(命令注入) 类弱点 1387 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-77即命令注入，属于输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，篡改后端系统命令，从而执行任意指令或获取敏感数据。开发者应避免直接拼接用户输入，需采用白名单过滤、参数化调用或安全API替代系统命令执行，确保输入被严格限制在预期范围内，从源头阻断注入风险。
prompt = "Explain the difference between {} and {}".format(arg1, arg2) result = invokeChatbot(prompt) resultHTML = encodeForHTML(result) print resultHTMLExplain the difference between CWE-77 and CWE-78my $arg = GetArgument("filename"); do_listing($arg); sub do_listing { my($fname) = @_; if (! validate_name($fname)) { print "Error: name is not well-formed!\n"; return; } # build command my $cmd = "/bin/ls -l $fname"; system($cmd); } sub validate_name { my($name) = @_; if ($name =~ /^[\w\-]+$/) { return(1); } else { return(0); } }if ($name =~ /^\w[\w\-]+$/) ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-22197 | Nginx UI 命令注入漏洞 — nginx-ui | 7.7 | High | 2024-01-11 |
| CVE-2024-20676 | Microsoft Azure Storage Mover 安全漏洞 — Azure Storage Mover | 8.0 | High | 2024-01-09 |
| CVE-2024-0291 | TOTOLINK LR1200GB 命令注入漏洞 — LR1200GB | 6.3 | Medium | 2024-01-08 |
| CVE-2023-47560 | QNAP Systems QuMagie 命令注入漏洞 — QuMagie | 7.4 | High | 2024-01-05 |
| CVE-2023-51664 | changed-files 安全漏洞 — changed-files | 7.3 | High | 2023-12-27 |
| CVE-2023-6940 | mlflow 命令注入漏洞 — mlflow/mlflow | 8.8 | - | 2023-12-19 |
| CVE-2023-6848 | kodbox 命令注入漏洞 — kodbox | 7.3 | High | 2023-12-16 |
| CVE-2023-49898 | Apache StreamPark 命令注入漏洞 — Apache StreamPark (incubating) | 8.8 | - | 2023-12-15 |
| CVE-2023-6572 | Gradio 信息泄露漏洞 — gradio-app/gradio | 7.5AI | High AI | 2023-12-14 |
| CVE-2023-25643 | ZTE MC801A 安全漏洞 — MC801A | 8.4 | High | 2023-12-14 |
| CVE-2023-48702 | Jellyfin 命令注入漏洞 — jellyfin | 7.2 | High | 2023-12-13 |
| CVE-2023-48791 | Fortinet FortiPortal 安全漏洞 — FortiPortal | 7.9 | High | 2023-12-13 |
| CVE-2023-49587 | SAP Solution Manager 命令注入漏洞 — SAP Solution Manager | 6.4 | Medium | 2023-12-12 |
| CVE-2023-6071 | Trellix Enterprise Security Manager 安全漏洞 — ESM | 8.4 | High | 2023-11-30 |
| CVE-2023-23369 | QNAP Systems QTS 操作系统命令注入漏洞 — Multimedia Console | 9.0 | Critical | 2023-11-03 |
| CVE-2023-20170 | Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software | 6.0 | Medium | 2023-11-01 |
| CVE-2023-5752 | Pip 命令注入漏洞 — pip | 5.5 | Medium | 2023-10-24 |
| CVE-2023-36414 | Microsoft Azure SDK 安全漏洞 — Azure Identity SDK for .NET | 8.8 | High | 2023-10-10 |
| CVE-2023-36415 | Microsoft Azure SDK 安全漏洞 — Azure Identity SDK for Java | 8.8 | High | 2023-10-10 |
| CVE-2023-4401 | Dell SmartFabric Storage Software 操作系统命令注入漏洞 — Dell SmartFabric Storage Software | 7.8 | High | 2023-10-05 |
| CVE-2023-41031 | Juplink RX4-1500 命令注入漏洞 — RX4-1500 | 8.0 | High | 2023-09-22 |
| CVE-2023-41029 | Juplink RX4-1500 命令注入漏洞 — RX4-1500 | 8.0 | High | 2023-09-22 |
| CVE-2023-42810 | systeminformation 命令注入漏洞 — systeminformation | 9.8 | Critical | 2023-09-21 |
| CVE-2023-43477 | Telstra Smart Modem 命令注入漏洞 — Smart Modem Gen 2 (Arcadyan LH1000) | 6.8 | Medium | 2023-09-20 |
| CVE-2023-36642 | FortiTester 操作系统命令注入漏洞 — FortiTester | 6.5 | Medium | 2023-09-13 |
| CVE-2023-33136 | Microsoft Azure DevOps Server 安全漏洞 — Azure DevOps Server 2020.0.2 | 8.8 | High | 2023-09-12 |
| CVE-2023-36805 | Microsoft Windows Scripting 安全漏洞 — Windows 10 Version 1809 | 7.0 | High | 2023-09-12 |
| CVE-2023-4310 | BeyondTrust Privileged Remote Access 和Remote Support 命令注入漏洞 — Privileged Remote Access (PRA) | 9.8 | - | 2023-09-05 |
| CVE-2023-40598 | Splunk 访问控制错误漏洞 — Splunk Enterprise | 8.5 | High | 2023-08-30 |
| CVE-2023-25649 | ZTE MF286R 命令注入漏洞 — MF286R | 6.8 | Medium | 2023-08-25 |
CWE-77（在命令中使用的特殊元素转义处理不恰当(命令注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1387 条 CVE 漏洞。