CWE-497 将系统数据暴露到未授权控制的范围 类弱点 352 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-497属于敏感信息泄露漏洞，指产品未能阻止未授权方访问底层系统信息。攻击者常利用网络通信中的错误响应或调试信息，获取操作系统、数据库配置等敏感细节，进而辅助后续攻击。开发者应严格限制错误信息的输出，确保仅返回必要的业务数据，并实施最小权限原则，防止敏感系统细节暴露给外部不可信实体。
char* path = getenv("PATH"); ... sprintf(stderr, "cannot find exe on path %s\n", path);//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78) $userName = getCurrentUser(); $command = 'ps aux | grep ' . $userName; system($command);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-62143 | WordPress plugin Post Video Players 安全漏洞 — Post Video Players | 4.3 | Medium | 2025-12-31 |
| CVE-2025-62114 | WordPress plugin Download Media Library 安全漏洞 — Download Media Library | 5.3 | Medium | 2025-12-31 |
| CVE-2025-69026 | WordPress plugin PopupKit 安全漏洞 — PopupKit | 4.3 | Medium | 2025-12-30 |
| CVE-2025-69025 | WordPress plugin Poptics 安全漏洞 — Poptics | 4.3 | Medium | 2025-12-30 |
| CVE-2025-68988 | WordPress plugin E-Invoice App Malaysia 安全漏洞 — E-Invoice App Malaysia | 5.3 | Medium | 2025-12-30 |
| CVE-2025-36229 | IBM Aspera Faspex 安全漏洞 — Aspera Faspex 5 | 3.1 | Low | 2025-12-26 |
| CVE-2025-68943 | Gitea 安全漏洞 — Gitea | 5.3 | Medium | 2025-12-26 |
| CVE-2025-68606 | WordPress plugin PostX 安全漏洞 — PostX | 5.3 | Medium | 2025-12-24 |
| CVE-2025-68576 | WordPress plugin Virusdie 安全漏洞 — Virusdie | 4.3 | Medium | 2025-12-24 |
| CVE-2025-67621 | WordPress plugin Eight Day Week Print Workflow 安全漏洞 — Eight Day Week Print Workflow | 4.3 | Medium | 2025-12-24 |
| CVE-2025-68494 | WordPress plugin Premium Addons for Elementor 安全漏洞 — Premium Addons for Elementor | 5.3 | Medium | 2025-12-24 |
| CVE-2025-68551 | WordPress plugin VPSUForm 安全漏洞 — VPSUForm | 6.5 | Medium | 2025-12-23 |
| CVE-2025-11545 | Sharp NP series 安全漏洞 — NP-PA1705UL-W, NP-PA1705UL-W+, NP-PA1705UL-B, NP-PA1705UL-B+, NP-PA1505UL-W, NP-PA1505UL-W+, NP-PA1505UL-B, NP-PA1505UL-B+, NP-PA1505UL-BJL NP-PV800UL-W, NP-PV800UL-W+, NP-PV800UL-B, NP-PV800UL-B+, NP-PV710UL-W, NP-PV710UL-W+, NP-PV710UL-B, NP-PV710UL-B+, NP-PV800UL-W1, NP-PV800UL-B1, NP-PV710UL-W1, NP-PV710UL-B1, NP-PV800UL-B1G, NP-PV710UL-B1G, NP-PV800UL-WH, NP-PV710UL-WH, NP-P627UL, NP-P627ULG, NP-P627UL+, NP-P547UL, NP-P547ULG, NP-P607UL+, NP-CG6600UL, NP-H6271UL, NP-H5471UL, NP-P627ULH, NP-P547ULH NP-PV710UL+ NP-PA1004UL-W, NP-PA1004UL-WG, NP-PA1004UL-W+, NP-PA1004UL-WH, NP-PA1004UL-B, NP-PA1004UL-BG, NP-PA1004UL-B+, NP-PA804UL-W, NP-PA804UL-WG, NP-PA804UL-W+, NP-PA804UL-WH, NP-PA804UL-B, NP-PA804UL-BG, NP-PA804UL-B+, NP-PA1004UL-BH, NP-PA804UL-BH, NP-PE455UL, NP-PE455ULG, NP-PE455WL, NP-PE455WLG, NP-PE505XLG, NP-CG6500XL, NP-CG6400UL, NP-CG6400WL, NP-CB4500XL, NP-CA4120X, NP-CA4160W, NP-CA4160X, NP-CA4200U, NP-CA4200W, NP-CA4202W, NP-CA4260X, NP-CA4300X, NP-CA4355X, NP-CD2100U, NP-CD2120X, NP-CD2300X, NP-CR2100X, NP-CR2170W, NP-CR2170X, NP-CR2200U, NP-CR2200W, NP-CR2280X, NP-CR2310X, NP-CR2350X, NP-MC302XG, NP-MC332WG, NP-MC342XG, NP-MC372X, NP-MC372XG, NP-MC382W, NP-MC382WG, NP-MC422XG, NP-ME342UG, NP-ME372W, NP-ME372WG, NP-ME382U, NP-ME382UG, NP-ME402X, NP-ME402XG NP-CU4300XD, NP-CU4200XD, NP-CU4200WD, NP-UM383WL, NP-UM383WLG, NP-CJ2200WD, NP-PH3501QL, NP-PH3501QL+, NP-PH2601QL, NP-PH2601QL+, NP-PH350Q40L, NP-PH260Q30L, NP-PX1005QL-W, NP-PX1005QL-B, NP-PX1005QL-B+, NP-P525UL, NP-P525ULG, NP-P525UL+, NP-P525WL, NP-P525WLG, NP-P525WL+, NP-P605UL, NP-P605ULG, NP-P605UL+ | 9.1AI | Critical AI | 2025-12-22 |
| CVE-2025-62955 | WordPress plugin TempTool 安全漏洞 — TempTool [Show Current Template Info] | 4.3 | Medium | 2025-12-21 |
| CVE-2024-58320 | Kentico Xperience 安全漏洞 — Xperience | 5.3 | Medium | 2025-12-18 |
| CVE-2019-25230 | Kentico Xperience 安全漏洞 — Xperience | 4.3 | Medium | 2025-12-18 |
| CVE-2019-25228 | Kentico Xperience 安全漏洞 — Xperience | 5.3 | Medium | 2025-12-18 |
| CVE-2025-67546 | WordPress plugin WP ERP 安全漏洞 — WP ERP | 6.5 | Medium | 2025-12-18 |
| CVE-2025-64270 | WordPress plugin Masteriyo - LMS 安全漏洞 — Masteriyo - LMS | 6.5 | Medium | 2025-12-18 |
| CVE-2025-64272 | WordPress plugin Email marketing for WordPress by GetResponse Official 安全漏洞 — Email marketing for WordPress by GetResponse Official | 6.5 | Medium | 2025-12-18 |
| CVE-2025-64258 | WordPress plugin Follow My Blog Post 安全漏洞 — Follow My Blog Post | 7.5 | High | 2025-12-18 |
| CVE-2025-49914 | WordPress plugin Restaurant Menu by MotoPress 安全漏洞 — Restaurant Menu by MotoPress | 6.5 | Medium | 2025-12-18 |
| CVE-2025-47319 | Qualcomm Chipsets 安全漏洞 — Snapdragon | 6.7 | Medium | 2025-12-18 |
| CVE-2025-34442 | AVideo 安全漏洞 — AVideo | 5.3AI | Medium AI | 2025-12-17 |
| CVE-2025-67948 | WordPress plugin SendPulse Email Marketing Newsletter 安全漏洞 — SendPulse Email Marketing Newsletter | 4.3 | Medium | 2025-12-16 |
| CVE-2025-14712 | JHENG GAO Student Learning Assessment and Support System 安全漏洞 — Student Learning Assessment and Support System | 7.5 | High | 2025-12-15 |
| CVE-2025-67717 | ZITADEL 安全漏洞 — zitadel | 4.3AI | Medium AI | 2025-12-11 |
| CVE-2025-63070 | WordPress plugin Download Manager 安全漏洞 — Download Manager | 4.3 | Medium | 2025-12-09 |
| CVE-2025-63058 | WordPress plugin Custom Field Template 安全漏洞 — Custom Field Template | 4.3 | Medium | 2025-12-09 |
| CVE-2025-63013 | WordPress plugin WP Hotel Booking 安全漏洞 — WP Hotel Booking | 4.3 | Medium | 2025-12-09 |
CWE-497（将系统数据暴露到未授权控制的范围） 是常见的弱点类别，本平台收录该类弱点关联的 352 条 CVE 漏洞。