CWE-552 对外部实体的文件或目录可访问 类弱点 242 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-552属于权限配置不当类漏洞，指产品错误地将文件或目录暴露给未授权的外部实体。攻击者通常利用此缺陷，通过直接访问服务器根目录下的敏感文件，窃取机密数据或执行恶意操作。开发者应避免在Web或FTP服务器中存放敏感文件，并实施严格的访问控制机制，确保仅授权用户可访问特定资源，从而防止信息泄露。
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access trueaz storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access falsegsutil iam get gs://BUCKET_NAME{ "bindings":[{ "members":[ "projectEditor: PROJECT-ID", "projectOwner: PROJECT-ID" ], "role":"roles/storage.legacyBucketOwner" }, { "members":[ "allUsers", "projectViewer: PROJECT-ID" ], "role":"roles/storage.legacyBucketReader" } ] }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-24732 | Hallo Welt! BlueSpice 安全漏洞 — BlueSpice | 6.5AI | Medium AI | 2026-03-04 |
| CVE-2020-37082 | webERP 安全漏洞 — webERP | 9.8 | Critical | 2026-02-03 |
| CVE-2026-25137 | Nixpkgs 安全漏洞 — nixpkgs | 9.1 | Critical | 2026-02-02 |
| CVE-2025-12648 | WordPress plugin WP-Members Membership Plugin 安全漏洞 — WP-Members Membership Plugin | 5.3 | Medium | 2026-01-07 |
| CVE-2025-15153 | PbootCMS 安全漏洞 — PbootCMS | 3.7 | Low | 2025-12-28 |
| CVE-2019-25239 | V-SOL GPON/EPON OLT Platform 安全漏洞 — GPON/EPON OLT Platform | 7.5 | High | 2025-12-24 |
| CVE-2018-25145 | Microhard Systems IPn4G 安全漏洞 — Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Configuration Download | 6.5 | Medium | 2025-12-24 |
| CVE-2025-14896 | kroki 安全漏洞 — kroki | 7.5 | High | 2025-12-18 |
| CVE-2025-14697 | Sixun Shanghui Business Management System 安全漏洞 — Sixun Shanghui Group Business Management System | 3.7 | Low | 2025-12-15 |
| CVE-2025-14442 | WordPress plugin Secure Copy Content Protection and Content Locking 安全漏洞 — Secure Copy Content Protection and Content Locking | 5.3 | Medium | 2025-12-12 |
| CVE-2025-12747 | WordPress plugin Tainacan 安全漏洞 — Tainacan | 5.3 | Medium | 2025-11-21 |
| CVE-2025-12894 | WordPress plugin Import WP 安全漏洞 — Import WP – Export and Import CSV and XML files to WordPress | 5.3 | Medium | 2025-11-21 |
| CVE-2021-4463 | Longjing BEMS API 安全漏洞 — BEMS API | 7.5 | - | 2025-11-12 |
| CVE-2025-11959 | Premierturk Excavation Management Information System 安全漏洞 — Excavation Management Information System | 8.1 | High | 2025-11-11 |
| CVE-2025-33150 | IBM Cognos Analytics Certified Containers 安全漏洞 — Cognos Analytics Certified Containers | 5.3 | Medium | 2025-11-10 |
| CVE-2025-58152 | Century Systems FutureNet MA-X series 安全漏洞 — FutureNet MA-X series | 5.3 | Medium | 2025-10-31 |
| CVE-2025-11965 | Eclipse Vert.x 安全漏洞 — Vert.x | 7.5AI | High AI | 2025-10-22 |
| CVE-2025-31996 | HCL Unica Platform 安全漏洞 — Unica Platform | 5.3 | Medium | 2025-10-13 |
| CVE-2025-59976 | Juniper Networks Junos Space 安全漏洞 — Junos Space | 6.5 | Medium | 2025-10-09 |
| CVE-2025-61734 | Apache Kylin 安全漏洞 — Apache Kylin | 9.1AI | Critical AI | 2025-10-02 |
| CVE-2025-3025 | Gen Digital CCleaner 安全漏洞 — CCleaner | 7.3 | High | 2025-09-15 |
| CVE-2025-59054 | dstack 安全漏洞 — dstack | 9.9 | - | 2025-09-12 |
| CVE-2025-9273 | CData API Server 安全漏洞 — API Server | 6.5 | - | 2025-09-02 |
| CVE-2025-52460 | DOS & CO SS1 安全漏洞 — SS1 | 7.5 | - | 2025-08-28 |
| CVE-2025-43758 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 7.5AI | High AI | 2025-08-22 |
| CVE-2009-10005 | ContentKeeper Web Appliance 安全漏洞 — Web Appliance | 7.5AI | High AI | 2025-08-20 |
| CVE-2025-43749 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 7.5AI | High AI | 2025-08-20 |
| CVE-2025-23276 | NVIDIA GPU Display Driver 安全漏洞 — GPU Display Drivers | 7.8 | High | 2025-08-02 |
| CVE-2025-30103 | Dell SmartFabric OS10 Software 安全漏洞 — SmartFabric OS10 Software | 5.5 | Medium | 2025-07-30 |
| CVE-2025-53536 | Roo Code 安全漏洞 — Roo-Code | 8.1 | High | 2025-07-07 |
CWE-552（对外部实体的文件或目录可访问） 是常见的弱点类别，本平台收录该类弱点关联的 242 条 CVE 漏洞。