CWE-497 将系统数据暴露到未授权控制的范围 类弱点 352 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-497属于敏感信息泄露漏洞，指产品未能阻止未授权方访问底层系统信息。攻击者常利用网络通信中的错误响应或调试信息，获取操作系统、数据库配置等敏感细节，进而辅助后续攻击。开发者应严格限制错误信息的输出，确保仅返回必要的业务数据，并实施最小权限原则，防止敏感系统细节暴露给外部不可信实体。
char* path = getenv("PATH"); ... sprintf(stderr, "cannot find exe on path %s\n", path);//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78) $userName = getCurrentUser(); $command = 'ps aux | grep ' . $userName; system($command);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-23288 | NVIDIA GPU Display Driver 安全漏洞 — GPU Display Drivers | 3.3 | Low | 2025-08-02 |
| CVE-2025-23287 | NVIDIA GPU Display Driver 安全漏洞 — GPU Display Drivers | 3.3 | Low | 2025-08-02 |
| CVE-2022-50237 | ed25519-dalek crate 安全漏洞 — ed25519-dalek | 5.9 | Medium | 2025-07-28 |
| CVE-2025-53862 | Red Hat Ansible 安全漏洞 — Red Hat Ansible Automation Platform 2 | 3.5 | Low | 2025-07-11 |
| CVE-2025-6390 | Broadcom Brocade SANnav 安全漏洞 — Brocade SANnav | 5.5AI | Medium AI | 2025-07-10 |
| CVE-2025-4662 | Broadcom Brocade SANnav 安全漏洞 — Brocade SANnav | 5.5AI | Medium AI | 2025-07-10 |
| CVE-2025-53364 | Parse Server 安全漏洞 — parse-server | 5.3 | Medium | 2025-07-10 |
| CVE-2025-7381 | Mautic Docker Image 安全漏洞 — Docker Mautic | 5.3 | Medium | 2025-07-09 |
| CVE-2025-2670 | IBM OpenPages 安全漏洞 — OpenPages | 4.3 | Medium | 2025-07-09 |
| CVE-2025-27369 | IBM OpenPages with Watson 安全漏洞 — OpenPages with Watson | 4.3 | Medium | 2025-07-08 |
| CVE-2025-53211 | WordPress plugin Audio Editor & Recorder 安全漏洞 — Audio Editor & Recorder | 5.3 | Medium | 2025-06-27 |
| CVE-2025-6561 | Hunt Electronic HBF-09KD 安全漏洞 — HBF-09KD | 9.8 | Critical | 2025-06-26 |
| CVE-2025-49147 | Umbraco 安全漏洞 — Umbraco-CMS | 5.3 | Medium | 2025-06-24 |
| CVE-2025-5416 | Red Hat build of Keycloak 安全漏洞 — Red Hat Build of Keycloak | 2.7 | Low | 2025-06-20 |
| CVE-2025-52719 | WordPress plugin ProfileGrid 安全漏洞 — ProfileGrid | 4.3 | Medium | 2025-06-20 |
| CVE-2025-4229 | Palo Alto Networks PAN-OS 安全漏洞 — Cloud NGFW | 5.3AI | Medium AI | 2025-06-13 |
| CVE-2025-31045 | WordPress plugin elfsight Contact Form widget 安全漏洞 — elfsight Contact Form widget | 7.5 | High | 2025-06-09 |
| CVE-2025-5893 | Honding Technology Smart Parking Management System 安全漏洞 — Smart Parking Management System | 9.8 | Critical | 2025-06-09 |
| CVE-2025-49419 | WordPress plugin Foxit eSign for WordPress 安全漏洞 — Foxit eSign for WordPress | 5.5 | Medium | 2025-06-06 |
| CVE-2025-23969 | WordPress plugin KI Live Video Conferences 安全漏洞 — KI Live Video Conferences | 5.3 | Medium | 2025-06-06 |
| CVE-2025-24473 | Fortinet FortiClientWindows 安全漏洞 — FortiClientWindows | 4.8 | Low | 2025-05-28 |
| CVE-2025-2236 | OpenText Advanced Authentication 安全漏洞 — Advanced Authentication | 9.1AI | Critical AI | 2025-05-27 |
| CVE-2025-30170 | ABB多款产品 安全漏洞 — ASPECT-Enterprise | 5.5 | Medium | 2025-05-22 |
| CVE-2025-4364 | Assured Telematics Fleet Management System 安全漏洞 — Fleet Management System | 9.1AI | Critical AI | 2025-05-20 |
| CVE-2025-39394 | WordPress plugin AnalyticsWP 安全漏洞 — AnalyticsWP | 5.3 | Medium | 2025-05-19 |
| CVE-2025-31062 | WordPress plugin Wishlist 安全漏洞 — Wishlist | 4.3 | Medium | 2025-05-16 |
| CVE-2025-32299 | WordPress plugin QuickCal 安全漏洞 — QuickCal - Appointment Booking Calendar for WordPress | 4.3 | Medium | 2025-05-16 |
| CVE-2025-48024 | Checkmate 安全漏洞 — Checkmate | 5.0 | Medium | 2025-05-15 |
| CVE-2025-30011 | SAP Supplier Relationship Management 安全漏洞 — SAP Supplier Relationship Management (Live Auction Cockpit) | 5.3 | Medium | 2025-05-13 |
| CVE-2025-46747 | Schweitzer Engineering Laboratories多款产品 安全漏洞 — SEL Blueframe OS | 5.7 | Medium | 2025-05-12 |
CWE-497（将系统数据暴露到未授权控制的范围） 是常见的弱点类别，本平台收录该类弱点关联的 352 条 CVE 漏洞。