目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-256 明文存储口令 类漏洞列表 171

CWE-256 明文存储口令 类弱点 171 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-256 指产品将密码以明文形式存储在内存或文件等资源中，属于数据保护不当类漏洞。攻击者若获取系统访问权限，可直接读取存储介质中的明文密码，进而冒充合法用户进行未授权访问或横向移动。开发者应避免直接存储明文，转而采用加盐哈希算法对密码进行不可逆处理，并确保密钥管理安全，从而有效防止凭据泄露风险。

MITRE CWE 官方描述
CWE：CWE-256 Plaintext Storage of a Password 英文：The product stores a password in plaintext within resources such as memory or files.
常见影响 (1)
Access ControlGain Privileges or Assume Identity
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.
缓解措施 (3)
Architecture and DesignAvoid storing passwords in easily accessible locations.
Architecture and DesignConsider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Effectiveness: None
代码示例 (2)
The following code reads a password from a properties file and uses the password to connect to a database.
... Properties prop = new Properties(); prop.load(new FileInputStream("config.properties")); String password = prop.getProperty("password"); DriverManager.getConnection(url, usr, password); ...
Bad · Java
The following code reads a password from the registry and uses the password to create a new network credential.
... String password = regKey.GetValue(passKey).toString(); NetworkCredential netCred = new NetworkCredential(username,password,domain); ...
Bad · Java
CVE ID标题CVSS风险等级Published
CVE-2020-37115 GUnet OpenEclass 安全漏洞 — GUnet OpenEclass 6.5 Medium2026-02-03
CVE-2025-12680 Brocade SANnav 安全漏洞 — SANnav 6.5AIMediumAI2026-02-02
CVE-2026-21417 Dell CloudBoost Virtual Appliance 安全漏洞 — CloudBoost Virtual Appliance 7.0 High2026-01-27
CVE-2025-25051 AutomationDirect CLICK Programmable Logic Controller 安全漏洞 — CLICK Programmable Logic Controller 6.1 Medium2026-01-22
CVE-2025-15113 Ksenia Security Lares 4.0 Home Automation 安全漏洞 — lares 8.4 High2025-12-30
CVE-2025-15128 ZKTeco BioTime 安全漏洞 — BioTime 5.3 Medium2025-12-28
CVE-2018-25130 Beward Intercom 安全漏洞 — BEWARD Intercom 6.2 Medium2025-12-24
CVE-2025-65009 WODESYS WD-R608U 安全漏洞 — WD-R608U 7.5AIHighAI2025-12-18
CVE-2024-42197 HCL Workload Scheduler 安全漏洞 — Workload Scheduler 5.5 Medium2025-12-11
CVE-2025-14183 SGAI Space1 安全漏洞 — Space1 NAS N1211DS 4.3 Medium2025-12-07
CVE-2025-13221 Intelbras UnniTI 安全漏洞 — UnniTI 5.3 Medium2025-11-15
CVE-2025-13187 Intelbras ICIP 安全漏洞 — ICIP 5.3 Medium2025-11-14
CVE-2025-9982 QuickCMS 安全漏洞 — QuickCMS 8.8 -2025-11-14
CVE-2025-46366 Dell CloudLink 安全漏洞 — CloudLink 6.7 Medium2025-11-05
CVE-2025-11193 Lenovo Tablets 安全漏洞 — Tab M11 TB330FU TB330XU 5.5 Medium2025-11-03
CVE-2025-61680 Minecraft RCON Terminal 安全漏洞 — Minecraft-rcon 6.5AIMediumAI2025-10-03
CVE-2025-34210 Vasion Print Virtual Appliance Host和Vasion Print Application 安全漏洞 — Print Virtual Appliance Host 8.8AIHighAI2025-10-02
CVE-2025-43938 Dell PowerProtect Data Manager 安全漏洞 — PowerProtect Data Manager 5.0 Medium2025-09-10
CVE-2025-46809 SUSE Manager 日志信息泄露漏洞 — Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1 5.7 Medium2025-07-31
CVE-2025-7357 LITEON IC48A 安全漏洞 — IC48A EV Charger 8.1AIHighAI2025-07-16
CVE-2025-1709 Endress+Hauser MEAC300-FNADE4 安全漏洞 — Endress+Hauser MEAC300-FNADE4 6.5 Medium2025-07-03
CVE-2025-6560 Sapido多款产品 安全漏洞 — BR071n 9.8 Critical2025-06-24
CVE-2025-5760 WordPress plugin Simple History 安全漏洞 — Simple History – Track, Log, and Audit WordPress Changes 4.9 Medium2025-06-06
CVE-2025-2500 Hitachi Asset Suite 安全漏洞 — Asset Suite 7.4 High2025-05-30
CVE-2025-48046 MICI NetFax Server 安全漏洞 — NetFax Server 6.5AIMediumAI2025-05-29
CVE-2025-33079 IBM Controller 安全漏洞 — Controller 6.5 Medium2025-05-27
CVE-2025-43005 SAP GUI 安全漏洞 — SAP GUI for Windows 4.3 Medium2025-05-13
CVE-2025-0936 Arista EOS 安全漏洞 — EOS 6.5 Medium2025-05-07
CVE-2025-4286 Intelbras InControl 安全漏洞 — InControl 2.7 Low2025-05-05
CVE-2025-2770 BEC Routers 安全漏洞 — Multiple Routers 6.5 -2025-04-23

CWE-256（明文存储口令） 是常见的弱点类别，本平台收录该类弱点关联的 171 条 CVE 漏洞。