CWE-346 源验证错误 类弱点 327 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-346 属于源验证错误漏洞，指产品未能正确验证数据或通信来源的有效性。攻击者通常通过伪造请求源或篡改通信上下文，诱导系统处理恶意数据，从而绕过安全控制或执行未授权操作。开发者应实施严格的源验证机制，如校验请求头、使用数字签名或验证通信通道，确保数据确实来自可信且预期的源头，以杜绝此类风险。
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-42998 | SAP Business One Integration Framework 访问控制错误漏洞 — SAP Business One Integration Framework | 5.3 | Medium | 2025-06-10 |
| CVE-2024-31127 | Zscaler Client Connector 安全漏洞 — Client Connector | 7.3 | High | 2025-06-04 |
| CVE-2025-30360 | webpack-dev-server 访问控制错误漏洞 — webpack-dev-server | 6.5 | Medium | 2025-06-03 |
| CVE-2025-5320 | Gradio 访问控制错误漏洞 — gradio | 3.7 | Low | 2025-05-29 |
| CVE-2025-46737 | Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator 安全漏洞 — SEL-5037 Grid Configurator | 7.4 | High | 2025-05-12 |
| CVE-2025-3462 | ASUS DriverHub 安全漏洞 — DriverHub | 10.0AI | Critical AI | 2025-05-09 |
| CVE-2025-43929 | kitty 安全漏洞 — kitty | 4.1 | Medium | 2025-04-20 |
| CVE-2025-3651 | iManage Work Desktop for Mac 安全漏洞 — Work Desktop for Mac | 8.4AI | High AI | 2025-04-17 |
| CVE-2024-45354 | Xiaomi shop 安全漏洞 — Xiaomi shop application | 4.3 | Medium | 2025-03-27 |
| CVE-2024-45353 | Xiaomi Quick App Framework 安全漏洞 — quick app framework | 4.3 | Medium | 2025-03-27 |
| CVE-2024-45352 | Xiaomi SmartHome APP 安全漏洞 — Xiaomi smarthome application | 8.8 | High | 2025-03-27 |
| CVE-2024-10956 | GPT Academic 访问控制错误漏洞 — binary-husky/gpt_academic | 6.1 | - | 2025-03-20 |
| CVE-2024-8487 | AgentScope 安全漏洞 — modelscope/agentscope | 9.1 | - | 2025-03-20 |
| CVE-2024-8183 | Prefect 访问控制错误漏洞 — prefecthq/prefect | 9.1 | - | 2025-03-20 |
| CVE-2024-11602 | feast 访问控制错误漏洞 — feast-dev/feast | 7.5 | - | 2025-03-20 |
| CVE-2024-6844 | Flask-CORS 安全漏洞 — corydolphin/flask-cors | 6.5 | - | 2025-03-20 |
| CVE-2024-8024 | NetEase QAnything 访问控制错误漏洞 — netease-youdao/qanything | 7.5 | - | 2025-03-20 |
| CVE-2024-7819 | Danswer 访问控制错误漏洞 — danswer-ai/danswer | 6.5 | - | 2025-03-20 |
| CVE-2025-2346 | IROAD X5 访问控制错误漏洞 — Dash Cam X5 | 5.6 | Medium | 2025-03-16 |
| CVE-2025-25306 | Misskey 安全漏洞 — misskey | 9.3 | Critical | 2025-03-10 |
| CVE-2025-25302 | Rembg 访问控制错误漏洞 — rembg | 5.9 | - | 2025-03-03 |
| CVE-2025-1102 | Q-Free MAXTIME Suite 访问控制错误漏洞 — MaxTime | 5.5 | Medium | 2025-02-12 |
| CVE-2024-55948 | Discourse 访问控制错误漏洞 — discourse | 8.2 | High | 2025-02-04 |
| CVE-2025-23023 | Discourse 访问控制错误漏洞 — discourse | 8.2 | High | 2025-02-04 |
| CVE-2024-57965 | Axios 安全漏洞 — axios | - | - | 2025-01-29 |
| CVE-2025-24010 | Vite 安全漏洞 — vite | 6.5 | Medium | 2025-01-20 |
| CVE-2023-46715 | Fortinet FortiOS 访问控制错误漏洞 — FortiProxy | 4.7 | Medium | 2025-01-14 |
| CVE-2024-55917 | Trend Micro Apex One 安全漏洞 — Trend Micro Apex One | 7.8 | High | 2024-12-31 |
| CVE-2024-10534 | Dataprom Informatics Personnel Attendance Control Systems (PACS)和Access Control Security Systems (ACSS) 访问控制错误漏洞 — Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) | 9.8AI | Critical AI | 2024-11-15 |
| CVE-2024-6674 | LoLLMs 访问控制错误漏洞 — parisneo/lollms-webui | 7.1AI | High AI | 2024-10-29 |
CWE-346（源验证错误） 是常见的弱点类别，本平台收录该类弱点关联的 327 条 CVE 漏洞。