CWE-77 在命令中使用的特殊元素转义处理不恰当(命令注入) 类弱点 1387 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-77即命令注入，属于输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，篡改后端系统命令，从而执行任意指令或获取敏感数据。开发者应避免直接拼接用户输入，需采用白名单过滤、参数化调用或安全API替代系统命令执行，确保输入被严格限制在预期范围内，从源头阻断注入风险。
prompt = "Explain the difference between {} and {}".format(arg1, arg2) result = invokeChatbot(prompt) resultHTML = encodeForHTML(result) print resultHTMLExplain the difference between CWE-77 and CWE-78my $arg = GetArgument("filename"); do_listing($arg); sub do_listing { my($fname) = @_; if (! validate_name($fname)) { print "Error: name is not well-formed!\n"; return; } # build command my $cmd = "/bin/ls -l $fname"; system($cmd); } sub validate_name { my($name) = @_; if ($name =~ /^[\w\-]+$/) { return(1); } else { return(0); } }if ($name =~ /^\w[\w\-]+$/) ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-20124 | Cisco Small Business 命令注入漏洞 — Cisco Small Business RV Series Router Firmware | 6.5 | Medium | 2023-04-05 |
| CVE-2023-20152 | Cisco Identity Services Engine 操作系统命令注入漏洞 — Cisco Identity Services Engine Software | 6.0 | Medium | 2023-04-05 |
| CVE-2023-20153 | Cisco Identity Services Engine 操作系统命令注入漏洞 — Cisco Identity Services Engine Software | 6.0 | Medium | 2023-04-05 |
| CVE-2023-28854 | nophp 命令注入漏洞 — nophp | 8.0 | High | 2023-04-03 |
| CVE-2023-28935 | Apache UIMA DUCC 命令注入漏洞 — Apache UIMA DUCC | 8.8 | - | 2023-03-30 |
| CVE-2023-1685 | HadSky 命令注入漏洞 — HadSky | 6.3 | Medium | 2023-03-29 |
| CVE-2023-23355 | QNAP Systems QTS 和 QuTS hero 命令注入漏洞 — QTS | 6.6 | Medium | 2023-03-29 |
| CVE-2022-43623 | D-Link DIR-1935 命令注入漏洞 — DIR-1935 | 6.8 | - | 2023-03-29 |
| CVE-2023-28430 | OneSignal命令注入漏洞 — react-native-onesignal | 7.3 | High | 2023-03-27 |
| CVE-2023-1456 | Ubiquiti EdgeRouter 命令注入漏洞 — EdgeRouter X | 7.2 | High | 2023-03-25 |
| CVE-2023-1457 | Ubiquiti EdgeRouter 命令注入漏洞 — EdgeRouter X | 7.2 | High | 2023-03-25 |
| CVE-2023-1458 | Ubiquiti EdgeRouter 命令注入漏洞 — EdgeRouter X | 7.2 | High | 2023-03-25 |
| CVE-2023-20097 | Cisco Access Point 命令注入漏洞 — Cisco Aironet Access Point Software | 4.6 | Medium | 2023-03-23 |
| CVE-2023-28425 | Redis Labs Redis 命令注入漏洞 — redis | 5.5 | Medium | 2023-03-20 |
| CVE-2015-10096 | Zarthus IRC Twitter Announcer Bot 命令注入漏洞 — IRC Twitter Announcer Bot | 5.0 | Medium | 2023-03-20 |
| CVE-2023-28110 | Jumpserver 命令注入漏洞 — jumpserver | 5.7 | Medium | 2023-03-16 |
| CVE-2023-27581 | GitHub Slug action 命令注入漏洞 — github-slug-action | 8.8 | High | 2023-03-13 |
| CVE-2023-0978 | Trellix Intelligent Sandbox 命令注入漏洞 — Trellix Intelligent Sandbox | 6.4 | Medium | 2023-03-13 |
| CVE-2023-0628 | Docker Desktop 命令注入漏洞 — Docker Desktop | 6.1 | Medium | 2023-03-13 |
| CVE-2023-1277 | kylinos kylin-system-updater 操作系统命令注入漏洞 — kylin-system-updater | 7.8 | High | 2023-03-08 |
| CVE-2021-4329 | json-logic-js 命令注入漏洞 — json-logic-js | 5.5 | Medium | 2023-03-05 |
| CVE-2023-1162 | DrayTek Vigor2960 命令注入漏洞 — Vigor 2960 | 7.2 | High | 2023-03-03 |
| CVE-2021-3855 | Liman MYS 命令注入漏洞 — Liman Central Management System | 8.8 | High | 2023-02-24 |
| CVE-2023-23917 | Rocket.Chat 安全漏洞 — Rocket.chat | 8.8 | - | 2023-02-23 |
| CVE-2023-25805 | Versionn 命令注入漏洞 — versionn | 9.8 | Critical | 2023-02-20 |
| CVE-2023-20075 | Cisco Secure Email 操作系统命令注入漏洞 — Cisco Secure Email | 6.0 | Medium | 2023-02-16 |
| CVE-2023-0861 | NetModule NSRW 操作系统命令注入漏洞 — NSRW | 7.2 | High | 2023-02-16 |
| CVE-2023-0849 | NETGEAR WNDR3700 命令注入漏洞 — WNDR3700v2 | 4.7 | Medium | 2023-02-15 |
| CVE-2023-21778 | Microsoft Dynamics 安全漏洞 — Microsoft Dynamics 365 Unified Service Desk | 8.0 | High | 2023-02-14 |
| CVE-2023-21805 | Microsoft Windows MSHTML Platform 安全漏洞 — Windows 10 Version 1507 | 7.8 | High | 2023-02-14 |
CWE-77（在命令中使用的特殊元素转义处理不恰当(命令注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1387 条 CVE 漏洞。