CWE-862 授权机制缺失 类弱点 6640 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-24697 | WordPress plugin Image Gallery 安全漏洞 — Image Gallery – Responsive Photo Gallery | 6.5 | Medium | 2025-02-03 |
| CVE-2025-24642 | WordPress plugin Setup Default Featured Image 安全漏洞 — Setup Default Featured Image | 6.5 | Medium | 2025-02-03 |
| CVE-2025-23527 | WordPress plugin WC Wallet 安全漏洞 — WC Wallet | 6.5 | Medium | 2025-02-03 |
| CVE-2024-13775 | WordPress plugin WooCommerce Support Ticket System 安全漏洞 — WooCommerce Support Ticket System | 5.4 | Medium | 2025-02-01 |
| CVE-2024-13371 | WordPress plugin WP Job Portal 安全漏洞 — WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | 5.3 | Medium | 2025-02-01 |
| CVE-2024-12825 | WordPress plugin Custom Related Posts 安全漏洞 — Custom Related Posts | 5.4 | Medium | 2025-02-01 |
| CVE-2025-0939 | WordPress plugin MagicForm 安全漏洞 — MagicForm | 6.3 | Medium | 2025-02-01 |
| CVE-2024-12171 | WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System 安全漏洞 — ELEX WordPress HelpDesk & Customer Ticketing System | 8.8 | High | 2025-02-01 |
| CVE-2024-13651 | WordPress plugin RapidLoad 安全漏洞 — RapidLoad AI – Optimize Web Vitals Automatically | 4.3 | Medium | 2025-02-01 |
| CVE-2024-12184 | WordPress plugin WordPress Contact Forms by Cimatti 安全漏洞 — Contact Forms by Cimatti | 5.3 | Medium | 2025-02-01 |
| CVE-2024-12620 | WordPress plugin AnimateGL Animations for WordPress 安全漏洞 — AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations | 5.3 | Medium | 2025-02-01 |
| CVE-2025-22265 | WordPress plugin EMI Calculator 安全漏洞 — EMI Calculator | 6.5 | Medium | 2025-01-31 |
| CVE-2025-22720 | WordPress plugin Booking and Rental Manager 安全漏洞 — Booking and Rental Manager | 5.8 | Medium | 2025-01-31 |
| CVE-2024-13530 | WordPress plugin Custom Login Page Styler 安全漏洞 — Login Page Styler – Custom WordPress Login Page Customizer & Security | 4.3 | Medium | 2025-01-31 |
| CVE-2024-13415 | WordPress plugin Food Menu 安全漏洞 — Food Menu – Restaurant Menu & Online Ordering for WooCommerce | 4.3 | Medium | 2025-01-31 |
| CVE-2024-13424 | WordPress plugin Ni Sales Commission For WooCommerce 安全漏洞 — Ni Sales Commission For WooCommerce | 4.3 | Medium | 2025-01-31 |
| CVE-2024-13717 | WordPress plugin Contact Form and Calls To Action by vcita 安全漏洞 — Contact Form and Calls To Action by vcita | 4.3 | Medium | 2025-01-31 |
| CVE-2024-13767 | WordPress plugin Live2DWebCanvas 安全漏洞 — Live2DWebCanvas | 8.1 | High | 2025-01-31 |
| CVE-2024-10591 | WordPress plugin MWB HubSpot for WooCommerce 安全漏洞 — MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics | 8.8 | High | 2025-01-30 |
| CVE-2024-12129 | WordPress plugin Royal Core 安全漏洞 — Royal Core | 8.8 | High | 2025-01-30 |
| CVE-2024-12822 | WordPress plugin Media Manager for UserPro 安全漏洞 — Media Manager for UserPro | 9.8 | Critical | 2025-01-30 |
| CVE-2024-13715 | WordPress plugin zStore Manager Basic 安全漏洞 — zStore Manager Basic | 4.3 | Medium | 2025-01-30 |
| CVE-2024-12821 | WordPress plugin Media Manager for UserPro 安全漏洞 — Media Manager for UserPro | 8.8 | High | 2025-01-30 |
| CVE-2024-13652 | WordPress plugin ECPay Ecommerce for WooCommerce 安全漏洞 — ECPay Ecommerce for WooCommerce | 4.3 | Medium | 2025-01-30 |
| CVE-2024-12269 | WordPress plugin Safe Ai Malware Protection for WP 安全漏洞 — Safe Ai Malware Protection for WP | 7.5 | High | 2025-01-30 |
| CVE-2024-11583 | WordPress plugin Borderless 安全漏洞 — Borderless – Addons and Templates for Elementor | 4.3 | Medium | 2025-01-30 |
| CVE-2025-21396 | Microsoft Account 安全漏洞 — Microsoft Account | 8.2 | High | 2025-01-29 |
| CVE-2025-23982 | WordPress plugin Cab fare calculator 安全漏洞 — Fare Calculator | 7.1 | High | 2025-01-27 |
| CVE-2025-24743 | WordPress plugin RomethemeKit For Elementor 安全漏洞 — RTMKit | 4.3 | Medium | 2025-01-27 |
| CVE-2025-24744 | WordPress plugin Bridge Core 安全漏洞 — Bridge Core | 4.3 | Medium | 2025-01-27 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 6640 条 CVE 漏洞。