CWE-639 通过用户控制密钥绕过授权机制 类弱点 1600 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-24842 | HGiga MailSherlock 安全漏洞 — MailSherlock | 5.3 | Medium | 2023-03-27 |
| CVE-2023-1462 | Vadi Corporate Information Systems 安全漏洞 — DigiKent | 8.8 | High | 2023-03-21 |
| CVE-2023-1463 | TeamPass 授权问题漏洞 — nilsteampassnet/teampass | 8.2 | - | 2023-03-17 |
| CVE-2023-28109 | Play With Docker 安全漏洞 — play-with-docker | 6.5 | Medium | 2023-03-16 |
| CVE-2023-0882 | Kron Single Connect 安全漏洞 — Single Connect | 8.8 | High | 2023-02-17 |
| CVE-2023-25160 | Nextcloud 安全漏洞 — security-advisories | 4.1 | Medium | 2023-02-13 |
| CVE-2023-0558 | WordPress plugin ContentStudio 安全漏洞 — ContentStudio | 8.2 | High | 2023-01-27 |
| CVE-2023-0550 | WordPress plugin Quick Restaurant Menu 安全漏洞 — Quick Restaurant Menu | 8.1 | High | 2023-01-27 |
| CVE-2023-22471 | Nextcloud 安全漏洞 — security-advisories | 3.5 | Low | 2023-01-14 |
| CVE-2022-46179 | LiuOS 安全漏洞 — LiuOS | 9.2 | Critical | 2022-12-28 |
| CVE-2022-4798 | memos 授权问题漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4799 | memos 授权问题漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4802 | memos 授权问题漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4803 | memos 访问控制错误漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4806 | memos 访问控制错误漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4811 | memos 授权问题漏洞 — usememos/memos | 8.3 | High | 2022-12-28 |
| CVE-2022-4812 | memos 安全漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4686 | memos 授权问题漏洞 — usememos/memos | 9.1 | - | 2022-12-23 |
| CVE-2022-3794 | WordPress plugin Jeg Elementor Kit 安全漏洞 — Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | 5.4 | Medium | 2022-12-22 |
| CVE-2022-3805 | WordPress plugin Jeg Elementor Kit 安全漏洞 — Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | 8.6 | High | 2022-12-22 |
| CVE-2022-4505 | OpenEMR 访问控制错误漏洞 — openemr/openemr | 8.8 | High | 2022-12-15 |
| CVE-2022-2808 | Student Information System 安全漏洞 — Prens Student Information System | 8.8 | High | 2022-12-12 |
| CVE-2022-3995 | WordPress plugin TeraWallet 安全漏洞 — Wallet for WooCommerce | 4.3 | Medium | 2022-11-29 |
| CVE-2022-3589 | Miele appWash 安全漏洞 — appWash | 8.1 | High | 2022-11-21 |
| CVE-2022-3282 | WordPress Plugin Drag and Drop Multiple File Upload 安全漏洞 — Drag and Drop Multiple File Upload – Contact Form 7 | 8.1 | - | 2022-10-17 |
| CVE-2022-1613 | WordPress plugin Restricted Site Access 安全漏洞 — Restricted Site Access | 5.3 | - | 2022-09-26 |
| CVE-2022-1580 | WordPress plugin Site Offline 安全漏洞 — Site Offline Or Coming Soon Or Maintenance Mode | 4.3 | - | 2022-09-19 |
| CVE-2022-2913 | WordPress plugin Login No Captcha reCAPTCHA 安全漏洞 — Login No Captcha reCAPTCHA | 4.3 | - | 2022-09-16 |
| CVE-2022-2877 | WordPress plugin Titan Anti-spam & Security 安全漏洞 — Titan Anti-spam & Security | 5.3 | - | 2022-09-16 |
| CVE-2022-2080 | WordPress plugin Sensei LMS 安全漏洞 — Sensei LMS – Online Courses, Quizzes, & Learning | 5.4 | - | 2022-08-29 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 1600 条 CVE 漏洞。