CWE-287 认证机制不恰当 类弱点 1488 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-15457 | MiniCMS 授权问题漏洞 — MiniCMS | 7.3 | High | 2026-01-05 |
| CVE-2025-15456 | MiniCMS 授权问题漏洞 — MiniCMS | 7.3 | High | 2026-01-05 |
| CVE-2025-15455 | MiniCMS 授权问题漏洞 — MiniCMS | 6.5 | Medium | 2026-01-05 |
| CVE-2025-15069 | Gmission Web Fax 安全漏洞 — Web Fax | 7.1 | High | 2025-12-29 |
| CVE-2025-15135 | Xiaozhi ESP32 Server Java 授权问题漏洞 — xiaozhi-esp32-server-java | 6.3 | Medium | 2025-12-28 |
| CVE-2025-15099 | Sim Studio 安全漏洞 — sim | 7.3 | High | 2025-12-26 |
| CVE-2025-15097 | Alteryx Server 授权问题漏洞 — Server | 7.3 | High | 2025-12-26 |
| CVE-2025-14908 | JeecgBoot 授权问题漏洞 — JeecgBoot | 6.3 | Medium | 2025-12-19 |
| CVE-2025-13427 | Google Cloud Dialogflow CX Messenger 安全漏洞 — Dialogflow CX Messenger | 9.1AI | Critical AI | 2025-12-18 |
| CVE-2025-14738 | TP-Link WA850RE 安全漏洞 — WA850RE | 7.5AI | High AI | 2025-12-18 |
| CVE-2025-44005 | Smallstep step-ca 安全漏洞 — Step-CA | 10.0 | Critical | 2025-12-17 |
| CVE-2025-14097 | Radiometer Products 安全漏洞 — ABL90 FLEX and ABL90 FLEX PLUS Analyzers | 7.2 | High | 2025-12-17 |
| CVE-2025-14002 | WordPress plugin WPCOM Member 授权问题漏洞 — WPCOM Member | 8.1 | High | 2025-12-16 |
| CVE-2025-14746 | Ningyuanda TC155 授权问题漏洞 — TC155 | 4.3 | Medium | 2025-12-16 |
| CVE-2025-37731 | Elasticsearch 安全漏洞 — Elasticsearch | 6.8 | Medium | 2025-12-15 |
| CVE-2025-14703 | SGWBox N3 授权问题漏洞 — sgwbox N3 | 5.3 | Medium | 2025-12-15 |
| CVE-2025-67507 | Filament 安全漏洞 — filament | 8.1 | High | 2025-12-10 |
| CVE-2025-66039 | FreePBX Endpoint Manager 授权问题漏洞 — framework | 7.4AI | High AI | 2025-12-09 |
| CVE-2025-66515 | Nextcloud 授权问题漏洞 — security-advisories | 2.7 | Low | 2025-12-05 |
| CVE-2025-12374 | WordPress plugin User Verification 授权问题漏洞 — User Verification by PickPlugins | 9.8 | Critical | 2025-12-05 |
| CVE-2025-9803 | Lunary 安全漏洞 — lunary-ai/lunary | 9.8AI | Critical AI | 2025-11-25 |
| CVE-2024-21635 | Memos 安全漏洞 — memos | 8.0 | - | 2025-11-14 |
| CVE-2025-64717 | ZITADEL 授权问题漏洞 — zitadel | 3.8 | - | 2025-11-13 |
| CVE-2025-64517 | sudo-rs 授权问题漏洞 — sudo-rs | 4.4 | Medium | 2025-11-12 |
| CVE-2025-12998 | TYPO3 Extension Modules 安全漏洞 — Extension "Modules" | 9.1 | - | 2025-11-12 |
| CVE-2025-64513 | milvus 授权问题漏洞 — milvus | 9.8 | - | 2025-11-10 |
| CVE-2025-64434 | Kubevirt 授权问题漏洞 — kubevirt | 4.7 | Medium | 2025-11-07 |
| CVE-2025-64432 | Kubevirt 信任管理问题漏洞 — kubevirt | 4.7 | Medium | 2025-11-07 |
| CVE-2025-3222 | GE Vernova Smallworld 安全漏洞 — Smallworld | 9.8 | - | 2025-11-07 |
| CVE-2025-20730 | MediaTek Chipsets 安全漏洞 — MT2737, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6990, MT6991, MT8188, MT8195, MT8676, MT8678, MT8696 | 6.7AI | Medium AI | 2025-11-04 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1488 条 CVE 漏洞。