CWE-620 未经验证的口令修改 类弱点 78 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-620 属于身份验证缺陷，指系统在修改用户密码时未验证原始密码或实施其他身份确认机制。攻击者可利用此漏洞，在无需知晓原密码的情况下篡改他人账户凭证，从而非法获取目标用户的系统权限与敏感数据。开发者应强制要求用户在更改密码前提供旧密码或完成多因素认证，确保操作者确为账户合法持有者，以阻断未授权访问风险。
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-2449 | WordPress Plugin UserPro 安全漏洞 — UserPro - Community and User Profile WordPress Plugin | 9.8 | Critical | 2023-11-22 |
| CVE-2023-4214 | WordPress Plugin AppPresser 安全漏洞 — AppPresser – Mobile App Framework | 8.1 | High | 2023-11-18 |
| CVE-2023-5844 | Pimcore 安全漏洞 — pimcore/admin-ui-classic-bundle | 8.8 | - | 2023-10-30 |
| CVE-2023-4915 | WordPress plugin WP User Control 安全漏洞 — WP User Control | 5.3 | Medium | 2023-09-13 |
| CVE-2023-4381 | iCMS 安全漏洞 — instantsoft/icms2 | 9.8 | - | 2023-08-16 |
| CVE-2023-3069 | coreBOS 授权问题漏洞 — tsolucio/corebos | 9.8 | - | 2023-06-02 |
| CVE-2023-2297 | WordPress plugin Profile Builder 授权问题漏洞 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 9.8 | Critical | 2023-04-26 |
| CVE-2023-25931 | Medtronic Pelvic Health 授权问题漏洞 — InsterStim Applications | 6.4 | Medium | 2023-03-01 |
| CVE-2022-3152 | phpfusion 授权问题漏洞 — phpfusion/phpfusion | 8.1 | - | 2022-09-07 |
| CVE-2022-2930 | OctoPrint 安全漏洞 — octoprint/octoprint | 7.1 | - | 2022-08-22 |
| CVE-2022-21935 | Johnson Controls Metasys ADS/ADX/OAS Servers 授权问题漏洞 — Metasys ADS/ADX/OAS server | 7.5 | High | 2022-06-15 |
| CVE-2022-21934 | Johnson Controls Metasys ADS/ADX/OAS servers 授权问题漏洞 — Metasys ADS/ADX/OAS server | 8.0 | High | 2022-05-06 |
| CVE-2021-34786 | Cisco BroadWorks CommPilot 授权问题漏洞 — Cisco BroadWorks | 6.5 | Medium | 2021-09-09 |
| CVE-2021-34785 | Cisco BroadWorks CommPilot 授权问题漏洞 — Cisco BroadWorks | 6.5 | Medium | 2021-09-09 |
| CVE-2021-22773 | EVlink City、EVlink Parking、EVlink Smart Wallbox 安全漏洞 — EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) | 6.5 | - | 2021-07-21 |
| CVE-2020-7378 | Crixp Opencrx 授权问题漏洞 — OpenCRX | 9.1 | Critical | 2020-11-24 |
| CVE-2018-8916 | Synology DiskStation Manager 安全漏洞 — DiskStation Manager (DSM) | 8.1 | - | 2018-06-08 |
| CVE-2017-14005 | ProMinent MultiFLEX M10a Controller Web界面安全漏洞 — ProMinent MultiFLEX M10a Controller | 8.8 | - | 2017-10-17 |
CWE-620（未经验证的口令修改） 是常见的弱点类别，本平台收录该类弱点关联的 78 条 CVE 漏洞。