CWE-348 使用不可信的源 类弱点 57 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-348 属于信任管理缺陷，指系统在处理相同数据时，优先采用验证能力弱、可信度低或抗攻击性差的来源。攻击者常通过操控不可信数据源，注入恶意内容以绕过安全校验，进而实施注入攻击或逻辑绕过。开发者应建立严格的数据信任分级机制，优先使用经过身份验证和完整性校验的可靠数据源，并对所有输入进行严格过滤与验证，确保关键决策仅基于可信信息。
$requestingIP = '0.0.0.0'; if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) { $requestingIP = $_SERVER['HTTP_X_FORWARDED_FOR']; else{ $requestingIP = $_SERVER['REMOTE_ADDR']; } if(in_array($requestingIP,$ipAllowlist)){ generatePage(); return; } else{ echo "You are not authorized to view this page"; return; }$requestingIP = '0.0.0.0'; if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) { echo "This application cannot be accessed through a proxy."; return; else{ $requestingIP = $_SERVER['REMOTE_ADDR']; } ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-53522 | Movable Type 安全漏洞 — Movable Type (Software Edition) | 7.5 | - | 2025-08-20 |
| CVE-2025-48825 | RICOH Streamline NX V3 PC Client 安全漏洞 — RICOH Streamline NX V3 PC Client | 7.5AI | HighAI | 2025-06-13 |
| CVE-2025-47149 | Digital Arts i-FILTER 安全漏洞 — i-FILTER | 7.7AI | HighAI | 2025-05-23 |
| CVE-2025-1245 | Hitachi Ops Center Analyzer和Hitachi Infrastructure Analytics Advisor 安全漏洞 — Hitachi Infrastructure Analytics Advisor | 6.5 | Medium | 2025-05-16 |
| CVE-2025-47424 | Retool 安全漏洞 — Retool | 7.1 | High | 2025-05-09 |
| CVE-2025-43918 | SSL.com 安全漏洞 — SSL.com | 6.4 | Medium | 2025-04-19 |
| CVE-2025-24856 | TYPO3 安全漏洞 — oidc | 4.2 | Medium | 2025-03-16 |
| CVE-2025-27913 | Passbolt 安全漏洞 — API | 3.7 | - | 2025-03-10 |
| CVE-2024-54840 | CyberArk Privileged Access Manager Self-Hosted 安全漏洞 — Privileged Access Manager | 4.2 | Medium | 2025-02-03 |
| CVE-2024-10977 | PostgreSQL 安全漏洞 — PostgreSQL | 3.1 | Low | 2024-11-14 |
| CVE-2022-4534 | WordPress plugin Limit Login Attempts 安全漏洞 — Limit Login Attempts (Spam Protection) | 5.3 | Medium | 2024-10-08 |
| CVE-2022-4533 | WordPress plugin Limit Login Attempts Plus 安全漏洞 — Limit Login Attempts Plus – WordPress Limit Login Attempts By Felix | 5.3 | Medium | 2024-09-19 |
| CVE-2022-4529 | WordPress plugin Security, Antivirus, Firewall – S.A.F 安全漏洞 — Security, Antivirus, Firewall – S.A.F | 5.3 | Medium | 2024-09-05 |
| CVE-2022-4539 | WordPress plugin Web Application Firewall 安全漏洞 — Web Application Firewall – website security | 5.3 | Medium | 2024-08-31 |
| CVE-2022-4536 | WordPress plugin IP Vault – WP Firewall 安全漏洞 — Two-factor authentication (formerly IP Vault) | 5.3 | Medium | 2024-08-31 |
| CVE-2022-4532 | WordPress plugin LOGIN AND REGISTRATION ATTEMPTS LIMIT 安全漏洞 — LOGIN AND REGISTRATION ATTEMPTS LIMIT | 6.5 | Medium | 2024-08-17 |
| CVE-2024-6171 | WordPress plugin Unlimited Elements For Elementor 安全漏洞 — Unlimited Elements For Elementor | 5.3 | Medium | 2024-07-09 |
| CVE-2022-44593 | WordPress plugin Solid Security 安全漏洞 — Solid Security | 3.7 | Low | 2024-06-21 |
| CVE-2024-0789 | WordPress plugin WP Maintenance 安全漏洞 — WP Maintenance | 5.3 | Medium | 2024-06-19 |
| CVE-2024-23105 | Fortinet FortiPortal 安全漏洞 — FortiPortal | 7.1 | High | 2024-05-14 |
| CVE-2024-27773 | Unitronics Unistream Unilogic 安全漏洞 — Unistream Unilogic | 8.8 | High | 2024-03-18 |
| CVE-2023-2897 | WordPress plugin Brizy Page Builder 数据伪造问题漏洞 — Brizy – Page Builder | 3.7 | Low | 2023-06-09 |
| CVE-2022-4537 | WordPress plugin Hide My WP Ghost 安全漏洞 — WP Ghost (Hide My WP Ghost) – Security & Firewall | 6.5 | Medium | 2023-05-09 |
| CVE-2022-2255 | mod_wsgi 数据伪造问题漏洞 — mod_wsgi | 7.5 | - | 2022-08-25 |
| CVE-2022-31813 | Apache HTTP Server 数据伪造问题漏洞 — Apache HTTP Server | 9.8 | - | 2022-06-08 |
| CVE-2021-21373 | Nimble 信任管理问题漏洞 — security | 7.5 | High | 2021-03-26 |
| CVE-2021-21374 | Nimble 信任管理问题漏洞 — security | 8.1 | High | 2021-03-26 |
CWE-348（使用不可信的源） 是常见的弱点类别，本平台收录该类弱点关联的 57 条 CVE 漏洞。