CWE-288 使用候选路径或通道进行的认证绕过 类弱点 547 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-11522 | WordPress plugin Search & Go Directory 安全漏洞 — Search & Go - Directory WordPress Theme | 9.8 | Critical | 2025-10-09 |
| CVE-2025-9914 | SICK AG Baggage Analytics 安全漏洞 — Baggage Analytics | 4.3 | Medium | 2025-10-06 |
| CVE-2025-6388 | WordPress plugin Spirit Framework 安全漏洞 — Spirit Framework | 9.8 | Critical | 2025-10-03 |
| CVE-2025-10653 | Raisecom MSG1200 安全漏洞 — Pro2 Series | 8.6 | High | 2025-10-02 |
| CVE-2025-22862 | Fortinet FortiOS 安全漏洞 — FortiProxy | 6.3 | Medium | 2025-10-02 |
| CVE-2025-61733 | Apache Kylin 安全漏洞 — Apache Kylin | 9.8AI | Critical AI | 2025-10-02 |
| CVE-2025-10538 | LG Innotek LND7210和LG Innotek LNV7210R 安全漏洞 — Camera Model LND7210 | 7.5AI | High AI | 2025-10-01 |
| CVE-2025-7038 | WordPress plugin LatePoint 安全漏洞 — LatePoint – Calendar Booking Plugin for Appointments and Events | 8.2 | High | 2025-09-30 |
| CVE-2025-5955 | WordPress plugin Service Finder SMS System 安全漏洞 — Service Finder SMS System | 8.1 | High | 2025-09-19 |
| CVE-2025-8359 | WordPress plugin AdForest 安全漏洞 — AdForest | 9.8 | Critical | 2025-09-06 |
| CVE-2025-54738 | WordPress plugin Jobmonster 安全漏洞 — Jobmonster | 9.8 | Critical | 2025-08-28 |
| CVE-2025-54725 | WordPress plugin Golo 安全漏洞 — Golo | 9.8 | Critical | 2025-08-28 |
| CVE-2025-34520 | Arcserve Unified Data Protection 安全漏洞 — Unified Data Protection (UDP) | 9.8AI | Critical AI | 2025-08-27 |
| CVE-2025-5821 | WordPress plugin Case Theme User 安全漏洞 — Case Theme User | 9.8 | Critical | 2025-08-23 |
| CVE-2025-5060 | WordPress plugin Bravis User 安全漏洞 — Bravis User | 8.1 | High | 2025-08-23 |
| CVE-2025-7642 | WordPress plugin Simpler Checkout 安全漏洞 — Simpler Checkout | 9.8 | Critical | 2025-08-23 |
| CVE-2025-24496 | Tenda AC6 安全漏洞 — AC6 V5.0 | 7.5 | High | 2025-08-20 |
| CVE-2025-27129 | Tenda AC6 安全漏洞 — AC6 V5.0 | 9.8 | Critical | 2025-08-20 |
| CVE-2025-54713 | WordPress plugin Taxi Booking Manager for WooCommerce 安全漏洞 — Taxi Booking Manager for WooCommerce | 9.8 | Critical | 2025-08-20 |
| CVE-2025-3639 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 9.8AI | Critical AI | 2025-08-18 |
| CVE-2025-8995 | Drupal Authenticator Login 安全漏洞 — Authenticator Login | 9.8AI | Critical AI | 2025-08-15 |
| CVE-2024-26009 | Fortinet多款产品 安全漏洞 — FortiProxy | 7.9 | High | 2025-08-12 |
| CVE-2025-40761 | Siemens多款产品 安全漏洞 — RUGGEDCOM ROX MX5000 | 7.6 | High | 2025-08-12 |
| CVE-2025-40743 | Siemens多款产品 安全漏洞 — SINUMERIK 828D PPU.4 | 8.3 | High | 2025-08-12 |
| CVE-2025-55012 | Zed 安全漏洞 — zed | 8.4AI | High AI | 2025-08-11 |
| CVE-2025-53187 | ABB ASPECT 代码注入漏洞 — ASPECT | 9.8 | Critical | 2025-08-11 |
| CVE-2025-24000 | WordPress Plugin WPExperts Post SMTP 安全漏洞 — Post SMTP | 8.8 | High | 2025-08-07 |
| CVE-2025-44957 | RUCKUS SmartZone 安全漏洞 — SmartZone | 8.5 | High | 2025-08-04 |
| CVE-2025-7710 | WordPress plugin Brave Conversion Engine 安全漏洞 — Brave Conversion Engine (PRO) | 9.8 | Critical | 2025-08-02 |
| CVE-2025-6895 | WordPress plugin Melapress Login Security 安全漏洞 — Melapress Login Security | 9.8 | Critical | 2025-07-26 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 547 条 CVE 漏洞。