CWE-88 参数注入或修改 类弱点 286 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-88 属于参数注入漏洞，指程序在构建外部命令字符串时，未正确界定参数边界。攻击者通过注入特殊字符（如空格或引号），将恶意参数伪装成合法选项，从而执行非预期的系统命令。开发者应避免直接拼接用户输入，转而使用接受独立参数数组的 API 调用命令，或严格过滤输入中的特殊字符，以确保命令解析的准确性与安全性。
my $arg = GetArgument("filename"); do_listing($arg); sub do_listing { my($fname) = @_; if (! validate_name($fname)) { print "Error: name is not well-formed!\n"; return; } # build command my $cmd = "/bin/ls -l $fname"; system($cmd); } sub validate_name { my($name) = @_; if ($name =~ /^[\w\-]+$/) { return(1); } else { return(0); } }if ($name =~ /^\w[\w\-]+$/) ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-44452 | Xreader 安全漏洞 — Xreader | 7.8 | - | 2024-05-03 |
| CVE-2024-3684 | GitHub Enterprise Server 安全漏洞 — Enterprise Server | 8.0 | High | 2024-04-19 |
| CVE-2024-32462 | Flatpak 安全漏洞 — flatpak | 8.4 | High | 2024-04-18 |
| CVE-2024-3817 | HashiCorp go-getter 安全漏洞 — Shared library | 9.8 | Critical | 2024-04-17 |
| CVE-2024-3367 | Checkmk 安全漏洞 — Checkmk | 6.5 | Medium | 2024-04-16 |
| CVE-2024-3775 | aEnrich a+HRD 参数注入漏洞 — a+HRD | 5.3 | Medium | 2024-04-15 |
| CVE-2024-22182 | Commend WS203VICM 参数注入漏洞 — WS203VICM | 8.6 | High | 2024-03-01 |
| CVE-2024-20287 | Cisco Business Wireless Access Points 安全漏洞 — Cisco Business Wireless Access Point Software | 6.5 | Medium | 2024-01-17 |
| CVE-2023-6634 | WordPress Plugin LearnPress 安全漏洞 — LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 8.1 | High | 2024-01-11 |
| CVE-2023-6792 | Palo Alto Networks PAN-OS 安全漏洞 — PAN-OS | 5.5 | Medium | 2023-12-13 |
| CVE-2023-49096 | Jellyfin 参数注入漏洞 — jellyfin | 7.7 | High | 2023-12-06 |
| CVE-2023-6269 | Atos Unify OpenScape SBC 安全漏洞 — OpenScape Session Border Controller (SBC) | 10.0 | Critical | 2023-12-05 |
| CVE-2023-0633 | Docker Desktop 参数注入漏洞 — Docker Desktop | 7.2 | High | 2023-09-25 |
| CVE-2023-26143 | Blamer 参数注入漏洞 — blamer | 6.5 | Medium | 2023-09-19 |
| CVE-2023-26310 | OPPO Find X3 命令注入漏洞 — OPPO Find X3 | 7.4 | High | 2023-08-09 |
| CVE-2023-34395 | Apache Airflow 参数注入漏洞 — Apache Airflow ODBC Provider | 9.8 | - | 2023-06-27 |
| CVE-2022-40677 | Fortinet FortiNAC 参数注入漏洞 — FortiNAC | 7.2 | High | 2023-02-16 |
| CVE-2022-4864 | Froxlor 注入漏洞 — froxlor/froxlor | 7.6 | - | 2022-12-30 |
| CVE-2022-44731 | Siemens部分产品 参数注入漏洞 — SIMATIC WinCC OA V3.15 | 5.4 | Medium | 2022-12-13 |
| CVE-2022-23740 | GitHub Enterprise Server 参数注入漏洞 — GitHub Enterprise Server | 8.8 | - | 2022-11-23 |
| CVE-2022-20930 | Cisco SD-WAN 操作系统命令注入漏洞 — Cisco SD-WAN vManage | 6.7 | Medium | 2022-09-30 |
| CVE-2022-1399 | Device42 参数注入漏洞 — CMDB | 9.1 | Critical | 2022-08-16 |
| CVE-2022-36322 | JetBrains TeamCity 参数注入漏洞 — TeamCity | 5.4 | Medium | 2022-07-20 |
| CVE-2022-31084 | LDAP Account Manager 参数注入漏洞 — lam | 8.8 | - | 2022-06-27 |
| CVE-2022-26532 | Zyxel USG/ZyWALL 操作系统命令注入漏洞 — USG/ZyWALL series firmware | 7.8 | High | 2022-05-24 |
| CVE-2022-29215 | RegionProtect 参数注入漏洞 — RegionProtect | 7.5 | High | 2022-05-21 |
| CVE-2021-43809 | Bundler 参数注入漏洞 — rubygems | 6.7 | Medium | 2021-12-08 |
| CVE-2021-34718 | Cisco IOS XR 参数注入漏洞 — Cisco IOS XR Software | 8.1 | High | 2021-09-09 |
| CVE-2021-3045 | Palo Alto Networks PAN-OS 参数注入漏洞 — PAN-OS | 4.9 | Medium | 2021-08-11 |
| CVE-2021-3540 | Mobileiron MobileIron Core参数注入漏洞 — MobileIron Core | 6.5 | Medium | 2021-07-22 |
CWE-88（参数注入或修改） 是常见的弱点类别，本平台收录该类弱点关联的 286 条 CVE 漏洞。