CWE-285 授权机制不恰当 类弱点 1213 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-285 属于权限控制缺陷，指系统在访问资源或执行操作时未正确执行授权检查。攻击者常通过篡改请求参数或绕过前端限制，以非授权身份访问敏感数据或执行特权操作。开发者应实施严格的基于角色的访问控制，在服务器端对所有请求进行细粒度权限验证，确保仅允许合法用户执行相应操作，从而杜绝越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-10390 | CRMEB 授权问题漏洞 — CRMEB | 5.4 | Medium | 2025-09-14 |
| CVE-2025-10389 | CRMEB 授权问题漏洞 — CRMEB | 5.4 | Medium | 2025-09-14 |
| CVE-2025-10384 | RuoYi 授权问题漏洞 — RuoYi | 5.4 | Medium | 2025-09-13 |
| CVE-2025-10374 | Sixun Business Management System 授权问题漏洞 — Business Management System | 7.3 | High | 2025-09-13 |
| CVE-2025-10319 | JeecgBoot 安全漏洞 — JeecgBoot | 4.3 | Medium | 2025-09-12 |
| CVE-2025-10318 | JeecgBoot 授权问题漏洞 — JeecgBoot | 6.3 | Medium | 2025-09-12 |
| CVE-2025-10291 | litemall 授权问题漏洞 — litemall | 6.3 | Medium | 2025-09-12 |
| CVE-2025-10278 | ruoyi-vue-pro 授权问题漏洞 — ruoyi-vue-pro | 6.3 | Medium | 2025-09-12 |
| CVE-2025-10277 | yudao-cloud 授权问题漏洞 — yudao-cloud | 6.3 | Medium | 2025-09-12 |
| CVE-2025-10276 | ruoyi-vue-pro 授权问题漏洞 — ruoyi-vue-pro | 6.3 | Medium | 2025-09-12 |
| CVE-2025-10275 | yudao-cloud 安全漏洞 — yudao-cloud | 6.3 | Medium | 2025-09-12 |
| CVE-2025-6088 | LibreChat 授权问题漏洞 — danny-avila/librechat | 4.3AI | Medium AI | 2025-09-11 |
| CVE-2025-10209 | Papermerge DMS 授权问题漏洞 — DMS | 5.4 | Medium | 2025-09-10 |
| CVE-2025-10086 | Weitong Mall 授权问题漏洞 — platform | 6.3 | Medium | 2025-09-08 |
| CVE-2025-10084 | ELADMIN 授权问题漏洞 — eladmin | 4.3 | Medium | 2025-09-08 |
| CVE-2025-10073 | i-Educar 授权问题漏洞 — i-Educar | 4.3 | Medium | 2025-09-07 |
| CVE-2025-10014 | ELADMIN 授权问题漏洞 — eladmin | 3.1 | Low | 2025-09-05 |
| CVE-2025-9937 | ELADMIN 授权问题漏洞 — eladmin | 5.4 | Medium | 2025-09-03 |
| CVE-2025-9936 | Weitong Mall 授权问题漏洞 — platform | 4.3 | Medium | 2025-09-03 |
| CVE-2025-9760 | i-Educar 安全漏洞 — i-Educar | 6.3 | Medium | 2025-09-01 |
| CVE-2025-9687 | Portábilis i-Educar 安全漏洞 — i-Educar | 6.3 | Medium | 2025-08-30 |
| CVE-2025-58156 | Centurion ERP 授权问题漏洞 — centurion_erp | 1.9 | Low | 2025-08-29 |
| CVE-2025-8147 | WordPress plugin LWSCache 授权问题漏洞 — LWSCache | 4.3 | Medium | 2025-08-29 |
| CVE-2025-9609 | i-Educar 安全漏洞 — i-Educar | 6.3 | Medium | 2025-08-29 |
| CVE-2025-9602 | Xinhu RockOA 安全漏洞 — RockOA | 6.3 | Medium | 2025-08-29 |
| CVE-2025-53795 | Microsoft PC Manager 授权问题漏洞 — Microsoft PC Manager | 9.1 | Critical | 2025-08-21 |
| CVE-2025-7221 | WordPress plugin GiveWP 授权问题漏洞 — GiveWP – Donation Plugin and Fundraising Platform | 4.3 | Medium | 2025-08-21 |
| CVE-2025-9151 | ThriveX-Blog 安全漏洞 — ThriveX-Blog | 6.3 | Medium | 2025-08-19 |
| CVE-2025-7778 | WordPress plugin Icons Factory 授权问题漏洞 — Icons Factory | 9.8 | Critical | 2025-08-15 |
| CVE-2025-55675 | Apache Superset 授权问题漏洞 — Apache Superset | 4.3AI | Medium AI | 2025-08-14 |
CWE-285（授权机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1213 条 CVE 漏洞。