CWE-287 认证机制不恰当 类弱点 1488 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-54918 | Microsoft NTLM 授权问题漏洞 — Windows 10 Version 1507 | 8.8 | High | 2025-09-09 |
| CVE-2025-55241 | Microsoft Entra 授权问题漏洞 — Microsoft Entra | 10.0 | Critical | 2025-09-04 |
| CVE-2025-52856 | QNAP VioStor 授权问题漏洞 — VioStor | 9.8 | - | 2025-08-29 |
| CVE-2025-7955 | WordPress plugin RingCentral Communications 授权问题漏洞 — RingCentral Communications Plugin – FREE | 9.8 | Critical | 2025-08-28 |
| CVE-2025-9533 | TOTOLINK T10 安全漏洞 — T10 | 7.3 | High | 2025-08-27 |
| CVE-2025-55293 | Meshtastic 授权问题漏洞 — firmware | 9.4 | Critical | 2025-08-18 |
| CVE-2025-8964 | Code-Projects Hostel Management System 安全漏洞 — Hostel Management System | 5.3 | Medium | 2025-08-14 |
| CVE-2025-55171 | WeGIA 授权问题漏洞 — WeGIA | 7.5 | High | 2025-08-12 |
| CVE-2025-55169 | WeGIA 路径遍历漏洞 — WeGIA | 7.5AI | High AI | 2025-08-12 |
| CVE-2025-53793 | Microsoft Azure Stack 路径遍历漏洞 — Azure Stack Hub 2406 | 7.5 | High | 2025-08-12 |
| CVE-2025-53778 | Microsoft NTLM 授权问题漏洞 — Windows 10 Version 1507 | 8.8 | High | 2025-08-12 |
| CVE-2025-8838 | my-site 安全漏洞 — my-site | 7.3 | High | 2025-08-11 |
| CVE-2025-54888 | Fedify 安全漏洞 — fedify | 9.8 | - | 2025-08-09 |
| CVE-2025-53786 | Microsoft Exchange Server 授权问题漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 8.0 | High | 2025-08-06 |
| CVE-2025-8348 | Kehua Charging Pile Cloud Platform 安全漏洞 — Charging Pile Cloud Platform | 7.3 | High | 2025-07-31 |
| CVE-2025-54573 | CVAT.ai CVAT 授权问题漏洞 — cvat | 4.3 | Medium | 2025-07-30 |
| CVE-2025-54419 | node-saml 安全漏洞 — node-saml | 10.0 | Critical | 2025-07-28 |
| CVE-2025-0249 | HCL Connections 安全漏洞 — IEM | 3.3 | Low | 2025-07-24 |
| CVE-2024-12310 | Imprivata Enterprise Access Management 授权问题漏洞 — Enterprise Access Management | 6.8 | - | 2025-07-23 |
| CVE-2025-54452 | SAMSUNG MagicINFO 9 Server 安全漏洞 — MagicINFO 9 Server | 7.3 | High | 2025-07-23 |
| CVE-2025-41459 | Two App Studio Journey 安全漏洞 — Journey | 7.8 | High | 2025-07-21 |
| CVE-2024-6107 | Canonical MAAS 安全漏洞 — MAAS | 9.6 | Critical | 2025-07-21 |
| CVE-2025-53771 | Microsoft SharePoint Server 授权问题漏洞 — Microsoft SharePoint Enterprise Server 2016 | 6.5 | Medium | 2025-07-20 |
| CVE-2025-7875 | Metasoft MetaCRM 授权问题漏洞 — MetaCRM | 7.3 | High | 2025-07-20 |
| CVE-2025-7699 | ASUSTOR ADM 安全漏洞 — ADM | 6.5AI | Medium AI | 2025-07-16 |
| CVE-2025-7703 | TECNO tech.palm.id 安全漏洞 — tech.palm.id | 7.5AI | High AI | 2025-07-16 |
| CVE-2025-49831 | CyberArk Conjur 授权问题漏洞 — conjur | 9.3AI | Critical AI | 2025-07-15 |
| CVE-2025-53889 | Directus 授权问题漏洞 — directus | 6.5 | Medium | 2025-07-14 |
| CVE-2025-7574 | LB-LINK多款产品 安全漏洞 — BL-AC1900 | 9.8 | Critical | 2025-07-14 |
| CVE-2025-49812 | Apache HTTP Server 授权问题漏洞 — Apache HTTP Server | 7.4AI | High AI | 2025-07-10 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1488 条 CVE 漏洞。