目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-472 对假设不可变Web参数的外部可控制 类漏洞列表 148

CWE-472 对假设不可变Web参数的外部可控制 类弱点 148 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-472指外部控制假设不可变Web参数漏洞。攻击者常通过修改隐藏表单字段、Cookie或URL参数，篡改本应固定的关键数据。开发者应避免依赖客户端数据，对任何输入进行服务端严格验证，确保业务逻辑不受用户可控参数影响，从而防止数据被恶意修改。

MITRE CWE 官方描述
CWE：CWE-472 外部对假定不可变 Web 参数的控制 英文：Web 应用程序未充分验证那些被假定为不可变但实际上可受外部控制的输入，例如隐藏表单字段。 如果 Web 产品未能正确保护隐藏表单字段、参数、Cookie 或 URL 中假定不可变的值免受修改，则可能导致关键数据被篡改。Web 应用程序经常错误地假设通过隐藏字段或 Cookie 传递给客户端的数据不易被篡改。对用户可控制的数据进行不当验证可能导致应用程序处理不正确且通常是恶意的输入。例如，自定义 Cookie 通常存储会话数据或跨会话的持久数据。这类会话数据通常参与服务器端与安全相关的决策，例如用户身份验证和访问控制。因此，Cookie 可能包含敏感数据，如用户凭据和权限。这是一种危险的做法，因为它经常导致服务器端应用程序不当依赖客户端提供的 Cookie 的值。
常见影响 (1)
Integrity Modify Application Data
Without appropriate protection mechanisms, the client can easily tamper with cookies and similar web data. Reliance on the cookies without detailed validation can lead to problems such as SQL injection. If you use cookie values for security related decisions on the server side, manipulating the cook…
缓解措施 (2)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
代码示例 (2)
In this example, a web application uses the value of a hidden form field (accountID) without having done any input validation because it was assumed to be immutable.
String accountID = request.getParameter("accountID"); User user = getUserFromID(Long.parseLong(accountID));
Bad · Java
Hidden fields should not be trusted as secure parameters.
<input type="hidden"
Bad · HTML
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-115450 Ecommerce 模板结账流程价格操纵漏洞 — Ecommerce Template 7.1 High 2026-10-22
CVE-2026-16453 Mattermost SAML RelayState 伪造导致未授权加入团队漏洞。 — Mattermost 7.1 High 2026-10-16
CVE-2026-111447 Wheels 4.1.2 嵌套表单任意更新删除漏洞 — Wheels 8.1 High 2026-10-16
CVE-2026-103671 EC-CUBE 4 AmazonPay插件外部控制Web参数漏洞 — AmazonPay V2 Plugin (4.0/4.1 series) 5.3 Medium 2026-10-14
CVE-2026-103080 WordPress Salevo插件<=1.3.0 访问控制漏洞 — Salevo 5.3 Medium 2026-10-12
CVE-2026-107636 pH7Builder 18.5.1前 支付模块远程代码执行漏洞 — ph7builder 6.5 Medium 2026-10-08
CVE-2026-107363 OpenStack Zaqar 19.1.0前越权漏洞 — Zaqar 6.1 Medium 2026-10-07
CVE-2026-82189 J2Store 1.0.0-4.1.7 任意订单状态篡改漏洞 — J2Store extension for Joomla 8.7 High 2026-09-15
CVE-2026-84762 WordPress WP EasyPay 输入验证错误漏洞 — WP EasyPay 5.3 Medium 2026-09-03
CVE-2026-77999 J2Store 未认证PayPal回调伪造漏洞 — J2Store extension for Joomla 8.7 High 2026-09-03
CVE-2026-67363 Joomla Balbooa Forms <2.4.3.2 支付金额篡改漏洞 — Balbooa Forms extension for Joomla 7.7 High 2026-08-19
CVE-2026-1982 WordPress Persian Elementor 输入验证错误漏洞 — المنتور فارسی 5.3 Medium 2026-07-30
CVE-2026-7484 ABiS AVESİS 输入验证错误漏洞 — AVESİS 5.3 Medium 2026-07-24
CVE-2026-65052 WordPress Ninja Forms 输入验证错误漏洞 — Ninja Forms 7.5 High 2026-07-21
CVE-2026-16089 Keycloak 安全漏洞 — Red Hat build of Keycloak 26.6 5.4 Medium 2026-07-17
CVE-2026-56877 Skillable SCORM Lab Launch Integration 输入验证错误漏洞 — SCORM Lab Launch Integration 6.3 Medium 2026-07-13
CVE-2026-59817 Ghost 输入验证错误漏洞 — Ghost 5.3 Medium 2026-07-09
CVE-2026-14430 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-07-01
CVE-2026-14389 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-07-01
CVE-2026-14391 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-07-01
CVE-2026-14387 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-07-01
CVE-2026-14069 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-30
CVE-2026-13974 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-30
CVE-2026-13938 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-30
CVE-2026-13841 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-30
CVE-2026-13801 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-30
CVE-2026-13796 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-30
CVE-2026-13281 Google Chrome 输入验证错误漏洞 — Chrome - - 2026-06-25
CVE-2026-42655 WPManageNinja Best Payments Plugin for WP 输入验证错误漏洞 — Best Payments Plugin for WP 7.5 Medium 2026-06-15
CVE-2025-59382 QNAP Systems多款产品 安全漏洞 — QTS - - 2026-06-10

CWE-472（对假设不可变Web参数的外部可控制） 是常见的弱点类别，本平台收录该类弱点关联的 148 条 CVE 漏洞。