CWE-285 授权机制不恰当 类弱点 1213 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-285 属于权限控制缺陷，指系统在访问资源或执行操作时未正确执行授权检查。攻击者常通过篡改请求参数或绕过前端限制，以非授权身份访问敏感数据或执行特权操作。开发者应实施严格的基于角色的访问控制，在服务器端对所有请求进行细粒度权限验证，确保仅允许合法用户执行相应操作，从而杜绝越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-61928 | Better Auth 安全漏洞 — better-auth | 7.5AI | High AI | 2025-10-09 |
| CVE-2025-59271 | Microsoft Azure Cache for Redis Enterprise 授权问题漏洞 — Azure Cache for Redis Enterprise | 8.7 | High | 2025-10-09 |
| CVE-2025-49594 | OpenID Connect 授权问题漏洞 — oidc | 8.8AI | High AI | 2025-10-06 |
| CVE-2025-11272 | ZKEACMS 授权问题漏洞 — ZKEACMS | 5.4 | Medium | 2025-10-04 |
| CVE-2025-11227 | WordPress plugin GiveWP 授权问题漏洞 — GiveWP – Donation Plugin and Fundraising Platform | 6.5 | Medium | 2025-10-04 |
| CVE-2025-11080 | wisdom-education 授权问题漏洞 — wisdom-education | 4.3 | Medium | 2025-09-27 |
| CVE-2025-11050 | Portábilis i-Educar 授权问题漏洞 — i-Educar | 6.3 | Medium | 2025-09-27 |
| CVE-2025-11049 | Portábilis i-Educar 授权问题漏洞 — i-Educar | 6.3 | Medium | 2025-09-27 |
| CVE-2025-11048 | Portábilis i-Educar 授权问题漏洞 — i-Educar | 6.3 | Medium | 2025-09-26 |
| CVE-2025-11047 | Portábilis i-Educar 授权问题漏洞 — i-Educar | 6.3 | Medium | 2025-09-26 |
| CVE-2025-11030 | Tutorials Website Employee Management System 授权问题漏洞 — Employee Management System | 7.3 | High | 2025-09-26 |
| CVE-2025-10992 | roncoo-pay 授权问题漏洞 — roncoo-pay | 5.3 | Medium | 2025-09-26 |
| CVE-2025-10989 | Ruoyi 授权问题漏洞 — RuoYi | 6.3 | Medium | 2025-09-26 |
| CVE-2025-10988 | ruoyi-vue-pro 授权问题漏洞 — ruoyi-vue-pro | 6.3 | Medium | 2025-09-26 |
| CVE-2025-10987 | yudao-cloud 授权问题漏洞 — yudao-cloud | 6.3 | Medium | 2025-09-26 |
| CVE-2025-10981 | JeecgBoot 授权问题漏洞 — JeecgBoot | 4.3 | Medium | 2025-09-26 |
| CVE-2025-10980 | JeecgBoot 授权问题漏洞 — JeecgBoot | 4.3 | Medium | 2025-09-25 |
| CVE-2025-10979 | JeecgBoot 授权问题漏洞 — JeecgBoot | 4.3 | Medium | 2025-09-25 |
| CVE-2025-10978 | JeecgBoot 授权问题漏洞 — JeecgBoot | 4.3 | Medium | 2025-09-25 |
| CVE-2025-10977 | JeecgBoot 授权问题漏洞 — JeecgBoot | 3.1 | Low | 2025-09-25 |
| CVE-2025-10976 | JeecgBoot 授权问题漏洞 — JeecgBoot | 3.1 | Low | 2025-09-25 |
| CVE-2025-10822 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-22 |
| CVE-2025-10821 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-22 |
| CVE-2025-10820 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-22 |
| CVE-2025-10819 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-22 |
| CVE-2025-10707 | JeecgBoot 安全漏洞 — JeecgBoot | 6.3 | Medium | 2025-09-19 |
| CVE-2025-10676 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-18 |
| CVE-2025-10675 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-18 |
| CVE-2025-10674 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-18 |
| CVE-2025-10422 | newbee-mall 授权问题漏洞 — newbee-mall | 4.3 | Medium | 2025-09-15 |
CWE-285（授权机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1213 条 CVE 漏洞。