目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-345 对数据真实性的验证不充分 类漏洞列表 414

CWE-345 对数据真实性的验证不充分 类弱点 414 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-345 属于数据完整性与真实性验证不足的安全漏洞。攻击者通常通过伪造或篡改数据源，使系统误信无效或恶意信息，从而执行非预期操作或泄露敏感数据。开发者应实施严格的身份认证机制，如使用数字签名或加密哈希，确保数据来源可信且未被篡改，并在关键业务逻辑前强制进行真实性校验，以阻断恶意数据的注入与处理。

MITRE CWE 官方描述
CWE：CWE-345 数据真实性验证不足 (Insufficient Verification of Data Authenticity) 英文：产品未能以足以防止其接受无效数据的方式，充分验证数据的来源或真实性。
常见影响 (1)
Integrity, Other Varies by Context, Unexpected State
代码示例 (1)
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-108568 InstantSoft icms2 Billing paypal.php 数据验证漏洞 — icms2 4.3 Medium 2026-10-11
CVE-2026-107420 WordPress Pay With MetaMask <=1.7.2 绕过漏洞 — Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway 5.3 Medium 2026-10-10
CVE-2026-107852 Jexactyl Stripe 支付确认绕过货币/金额不匹配 — Jexactyl 7.1 High 2026-10-09
CVE-2026-13257 IBM DataPower Gateway 数据真实性验证不足 — DataPower Gateway 10.6CD 6.5 Medium 2026-10-08
CVE-2026-107284 AsyncHttpClient WebSocket握手失败后Sec-WebSocket-Accept检查继续 — async-http-client 3.7 Low 2026-10-07
CVE-2026-105818 Vault PKI ACME 未验证 SAN 签发证书漏洞 — Vault 5.9 Medium 2026-10-07
CVE-2026-107102 Manacle Technologies ERP系统账号接管漏洞 — Multi-tenant ERP System 9.3 Critical 2026-10-07
CVE-2026-16516 wolfSSH ECDSA主机密钥曲线未验证 — wolfSSH 9.0 Critical 2026-10-07
CVE-2026-104850 MCP TypeScript SDK OAuth凭据泄露漏洞 — typescript-sdk 7.5 High 2026-10-06
CVE-2026-59357 Self-UAA OIDC配置JWT注入导致未授权会话漏洞 — UAA 6.5 Medium 2026-10-06
CVE-2026-104422 Zebra 6.3.0 之前版本通过Coinbase脚本签名重写导致区块同步拒绝服务漏洞 — zebra 7.5 High 2026-10-02
CVE-2026-104419 Zebra <6.3.0 Honest Peer 通过超前 FindBlocks 哈希被封禁 — zebra 4.8 Medium 2026-10-02
CVE-2026-103878 Apache Directory LDAP API StartTLS期间明文响应注入漏洞 — Apache Directory LDAP API - - 2026-10-02
CVE-2026-102140 Kiteworks Core 数据真实性验证不足漏洞 — Core 4.9 Medium 2026-09-30
CVE-2026-55174 UltrafastSecp256k1 签名验证绕过漏洞 — UltrafastSecp256k1 5.9 Medium 2026-09-30
CVE-2026-102275 PyJWT 密钥身份混淆漏洞 — pyjwt 6.5 Medium 2026-09-28
CVE-2026-100872 Sylius 2.x Payment Amount Overwrite 漏洞 — Sylius 7.5 High 2026-09-27
CVE-2026-92161 FriendsOfFlarum OAuth 未验证邮箱信任导致未授权账户接管 — oauth 9.8 Critical 2026-09-25
CVE-2026-81630 Botslab G980H行车记录仪数据真实性验证不足漏洞 — G980H 8.1 High 2026-09-24
CVE-2026-28324 SolarWinds Observability 远程代码执行漏洞 — Observability Self-Hosted 9.8 Critical 2026-09-22
CVE-2026-49450 Joplin Windows 自动更新器签名验证缺失漏洞 — joplin 7.1 High 2026-09-21
CVE-2026-63405 AnyCable Pusher API 重放任意请求漏洞 — anycable 5.9 Medium 2026-09-18
CVE-2026-62874 Azure Billing 提权漏洞 — Azure Billing 10.0 Critical 2026-09-17
CVE-2026-54608 MythicalDash Stripe支付端点未授权免费充值漏洞 — MythicalDash 7.1 High 2026-09-17
CVE-2026-54239 FaustWP令牌初始化向量修改认证绕过漏洞 — faustjs 8.8 High 2026-09-17
CVE-2026-54581 Bootstrap索引哈希校验失败 — mport 8.3 High 2026-09-17
CVE-2026-86038 libp2p Gossipsub 伪造攻击者签名漏洞 — js-libp2p 7.5 High 2026-09-17
CVE-2026-26950 Dell SmartFabric Manager 2.2.1前权限提升 — SmartFabric Manager 8.1 High 2026-09-17
CVE-2026-78296 WordPress FluentAuth 2.1.2 邮箱验证绕过漏洞 — FluentAuth 5.3 Medium 2026-09-17
CVE-2026-61591 djust 无签名客户端状态快照恢复权限提升漏洞 — djust 8.1 High 2026-09-16

CWE-345（对数据真实性的验证不充分） 是常见的弱点类别，本平台收录该类弱点关联的 414 条 CVE 漏洞。