CWE-287 认证机制不恰当 类弱点 1488 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-62717 | Emlog Pro 安全漏洞 — emlog | 8.1 | - | 2025-10-24 |
| CVE-2025-43995 | Dell Storage Manager 授权问题漏洞 — Dell Storage Manager | 9.8 | Critical | 2025-10-24 |
| CVE-2025-6979 | Arista Edge Threat Management - Arista Next Generation Firewall Versions 安全漏洞 — Arista Edge Threat Management - Arista Next Generation Firewall | 8.8 | High | 2025-10-23 |
| CVE-2025-62169 | OctoPrint-SpoolManager 授权问题漏洞 — OctoPrint-SpoolManager | 8.1 | High | 2025-10-23 |
| CVE-2025-62398 | Moodle 安全漏洞 | 8.1AI | High AI | 2025-10-23 |
| CVE-2025-41110 | Ghost Robotics Vision 60 授权问题漏洞 — Vision 60 | 8.8AI | High AI | 2025-10-22 |
| CVE-2025-41108 | Ghost Robotics Vision 60 授权问题漏洞 — Vision 60 | 9.8AI | Critical AI | 2025-10-22 |
| CVE-2025-11625 | wolfSSH 安全漏洞 — wolfSSH | 9.8AI | Critical AI | 2025-10-21 |
| CVE-2025-61922 | PrestaShop Checkout 授权问题漏洞 — ps_checkout | 9.1 | Critical | 2025-10-16 |
| CVE-2025-10293 | WordPress plugin Keyy Two Factor Authentication 授权问题漏洞 — Keyy Two Factor Authentication (like Clef) | 8.8 | High | 2025-10-15 |
| CVE-2025-62376 | DOJO 授权问题漏洞 — dojo | 9.8AI | Critical AI | 2025-10-14 |
| CVE-2025-59280 | Microsoft Windows SMB Client 授权问题漏洞 — Windows 10 Version 1507 | 3.1 | Low | 2025-10-14 |
| CVE-2025-55340 | Microsoft Windows Remote Desktop Services 授权问题漏洞 — Windows 10 Version 21H2 | 7.0 | High | 2025-10-14 |
| CVE-2025-53845 | Fortinet FortiAnalyzer 授权问题漏洞 — FortiAnalyzer | 6.2 | Medium | 2025-10-14 |
| CVE-2025-9064 | Rockwell Automation FactoryTalk View Machine Edition 安全漏洞 — FactoryTalk View Machine Edition | 8.1AI | High AI | 2025-10-14 |
| CVE-2025-9063 | Rockwell Automation PanelView Plus 7 Performance Series B 安全漏洞 — PanelView Plus 7 Performance Series B | 9.1AI | Critical AI | 2025-10-14 |
| CVE-2025-11192 | Extreme Networks Fabric Engine 安全漏洞 — Fabric Engine (VOSS) | 7.5AI | High AI | 2025-10-07 |
| CVE-2025-11287 | MCPHub 安全漏洞 — MCPHub | 7.3 | High | 2025-10-05 |
| CVE-2025-54154 | QNAP Authenticator 授权问题漏洞 — QNAP Authenticator | 6.8AI | Medium AI | 2025-10-03 |
| CVE-2025-61665 | WeGIA 安全漏洞 — WeGIA | 7.5 | - | 2025-10-02 |
| CVE-2025-41064 | GTT GROUP OpenSIAC 授权问题漏洞 — OpenSIAC | 9.8AI | Critical AI | 2025-10-02 |
| CVE-2025-20160 | Cisco IOS和Cisco IOS XE Software 授权问题漏洞 — IOS | 8.1 | High | 2025-09-24 |
| CVE-2025-9965 | Novakon P series 安全漏洞 — P series (P07, P10, P12, P15) | 9.1AI | Critical AI | 2025-09-23 |
| CVE-2025-34186 | Ilevia EVE X1 Server和Ilevia EVE X5 Server 安全漏洞 — EVE X1/X5 Server | 9.8AI | Critical AI | 2025-09-16 |
| CVE-2025-10365 | Evertz SDVN 3080ipx-10G 安全漏洞 — 3080ipx-10G | 9.8 | - | 2025-09-12 |
| CVE-2025-10288 | roncoo-pay 安全漏洞 — roncoo-pay | 5.3 | Medium | 2025-09-12 |
| CVE-2025-58065 | Flask App Builder 授权问题漏洞 — Flask-AppBuilder | 6.5 | Medium | 2025-09-11 |
| CVE-2025-58060 | OpenPrinting CUPS 授权问题漏洞 — cups | 8.0 | High | 2025-09-11 |
| CVE-2025-10224 | AxxonSoft AxxonOne 安全漏洞 — AxxonOne C-Werk | 5.4 | Medium | 2025-09-10 |
| CVE-2025-55234 | Microsoft Windows SMB Server 授权问题漏洞 — Windows 10 Version 1507 | 8.8 | High | 2025-09-09 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1488 条 CVE 漏洞。