CWE-287 认证机制不恰当 类弱点 1488 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-49706 | Microsoft Office Sharepoint Server 授权问题漏洞 — Microsoft SharePoint Enterprise Server 2016 | 6.5 | Medium | 2025-07-08 |
| CVE-2025-53545 | Frappe Technologies Frappe 授权问题漏洞 — press | 9.8AI | Critical AI | 2025-07-08 |
| CVE-2025-21450 | Qualcomm Chipsets 授权问题漏洞 — Snapdragon | 9.1 | Critical | 2025-07-08 |
| CVE-2025-6926 | Wikimedia Mediawiki CentralAuth Extension 安全漏洞 — Mediawiki - CentralAuth Extension | 9.8AI | Critical AI | 2025-07-03 |
| CVE-2025-52553 | authentik 授权问题漏洞 — authentik | 9.1AI | Critical AI | 2025-06-27 |
| CVE-2025-53013 | Himmelblau 授权问题漏洞 — himmelblau | 5.2 | Medium | 2025-06-26 |
| CVE-2025-52572 | Hikka 授权问题漏洞 — Hikka | 10.0 | Critical | 2025-06-24 |
| CVE-2025-52571 | Hikka 授权问题漏洞 — Hikka | 9.7 | Critical | 2025-06-24 |
| CVE-2025-49851 | Control iD iDSecure On-premises 授权问题漏洞 — iDSecure On-premises | 9.8AI | Critical AI | 2025-06-24 |
| CVE-2025-6528 | 70mai M300 授权问题漏洞 — M300 | 4.3 | Medium | 2025-06-23 |
| CVE-2025-6524 | 70mai 1S 授权问题漏洞 — 1S | 3.1 | Low | 2025-06-23 |
| CVE-2024-45347 | Xiaomi Mi Connect Service APP 授权问题漏洞 — Xiaomi Mi Connect Service | 9.6 | Critical | 2025-06-23 |
| CVE-2025-6172 | TECNO com.afmobi.boomplayer 安全漏洞 — com.afmobi.boomplayer | 8.8AI | High AI | 2025-06-16 |
| CVE-2025-6083 | Extreme Universal ZTNA 授权问题漏洞 — ExtremeCloud Universal ZTNA | 5.3AI | Medium AI | 2025-06-13 |
| CVE-2025-49146 | pgJDBC 授权问题漏洞 — pgjdbc | 8.2 | High | 2025-06-11 |
| CVE-2025-5985 | code-projects School Fees Payment System 授权问题漏洞 — School Fees Payment System | 7.3 | High | 2025-06-10 |
| CVE-2025-5870 | TRENDnet TV-IP121W 授权问题漏洞 — TV-IP121W | 7.3 | High | 2025-06-09 |
| CVE-2024-13088 | QNAP QHora 授权问题漏洞 — QuRouter | 7.8AI | High AI | 2025-06-06 |
| CVE-2025-48909 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 7.1 | High | 2025-06-06 |
| CVE-2025-49012 | Himmelblau 授权问题漏洞 — himmelblau | 5.4 | Medium | 2025-06-05 |
| CVE-2025-5597 | Airleader Master 安全漏洞 — airleader MASTER | 9.8AI | Critical AI | 2025-06-04 |
| CVE-2025-49001 | DataEase 授权问题漏洞 — dataease | 5.3AI | Medium AI | 2025-06-03 |
| CVE-2025-5512 | shiyi-blog 授权问题漏洞 — shiyi-blog | 7.3 | High | 2025-06-03 |
| CVE-2025-46548 | Apache Pekko Management 安全漏洞 — Apache Pekko Management | 9.8AI | Critical AI | 2025-06-03 |
| CVE-2025-5495 | NETGEAR WNR614 安全漏洞 — WNR614 | 7.3 | High | 2025-06-03 |
| CVE-2025-5437 | Multilaser Sirius RE016 授权问题漏洞 — Sirius RE016 | 5.3 | Medium | 2025-06-02 |
| CVE-2025-48370 | auth-js 路径遍历漏洞 — auth-js | 2.7 | Low | 2025-05-27 |
| CVE-2025-5247 | HFish 授权问题漏洞 — HFish | 7.3 | High | 2025-05-27 |
| CVE-2025-5149 | WCMS 授权问题漏洞 — WCMS | 5.6 | Medium | 2025-05-25 |
| CVE-2024-7487 | WSO2 Identity Server（IS） 安全漏洞 — WSO2 Identity Server | 5.8 | Medium | 2025-05-22 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1488 条 CVE 漏洞。