CWE-639 通过用户控制密钥绕过授权机制 类弱点 2041 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-9862 | WordPress plugin Miniorange OTP Verification with Firebase 安全漏洞 — Miniorange OTP Verification with Firebase | 9.8 | Critical | 2024-10-17 |
| CVE-2024-8040 | Dassault Systèmes 3DEXPERIENCE 安全漏洞 — 3DSwymer | 7.7 | High | 2024-10-16 |
| CVE-2023-7286 | WordPress plugin ACF Quick Edit Fields 安全漏洞 — ACF Quick Edit Fields | 6.5 | Medium | 2024-10-16 |
| CVE-2024-49388 | Acronis Cyber Protect 安全漏洞 — Acronis Cyber Protect 16 | 8.2 | - | 2024-10-15 |
| CVE-2024-9687 | WordPress plugin WP 2FA with Telegram 安全漏洞 — AuthPress | 8.8 | High | 2024-10-15 |
| CVE-2024-47495 | Juniper Networks Junos OS Evolved 安全漏洞 — Junos OS Evolved | 6.7 | Medium | 2024-10-11 |
| CVE-2024-7041 | Open WebUI 安全漏洞 — open-webui/open-webui | 4.3AI | Medium AI | 2024-10-09 |
| CVE-2024-9554 | Sovell Smart Canteen System 安全漏洞 — Smart Canteen System | 3.7 | Low | 2024-10-06 |
| CVE-2024-47316 | WordPress plugin Salon booking system 安全漏洞 — Salon booking system | 4.3 | Medium | 2024-10-05 |
| CVE-2024-47657 | Shilpi Net Back Office 安全漏洞 — Net Back Office | 6.5 | - | 2024-10-04 |
| CVE-2024-20513 | Cisco AnyConnect VPN 安全漏洞 — Cisco Meraki MX Firmware | 5.8 | Medium | 2024-10-02 |
| CVE-2024-39319 | Aimeos frontend controller 安全漏洞 — ai-controller-frontend | - | - AI | 2024-09-26 |
| CVE-2024-8290 | WordPress plugin WCFM 安全漏洞 — WCFM – Frontend Manager for WooCommerce | 8.8 | High | 2024-09-25 |
| CVE-2024-8485 | WordPress plugin REST API TO MiniProgram 安全漏洞 — REST API TO MiniProgram | 9.8 | Critical | 2024-09-25 |
| CVE-2024-8791 | WordPress plugin Donation Forms by Charitable 安全漏洞 — Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | 9.8 | Critical | 2024-09-24 |
| CVE-2024-45806 | Envoy 安全漏洞 — envoy | 6.5 | Medium | 2024-09-19 |
| CVE-2024-45614 | Puma 安全漏洞 — puma | 5.4 | Medium | 2024-09-19 |
| CVE-2024-46982 | Next.js 安全漏洞 — next.js | 7.5 | High | 2024-09-17 |
| CVE-2024-45605 | Sentry 安全漏洞 — sentry | 6.5 | Medium | 2024-09-17 |
| CVE-2024-45606 | Sentry 安全漏洞 — sentry | 7.1 | High | 2024-09-17 |
| CVE-2024-6685 | GitLab Enterprise Edition、GitLab Community Edition 安全漏洞 — GitLab | 3.1 | Low | 2024-09-16 |
| CVE-2022-3459 | WordPress plugin WooCommerce Multiple Free Gift 安全漏洞 — WooCommerce Multiple Free Gift | 5.3 | Medium | 2024-09-14 |
| CVE-2024-6087 | Lunary 访问控制错误漏洞 — lunary-ai/lunary | 8.8AI | High AI | 2024-09-13 |
| CVE-2024-3306 | Utarit SoliClub 安全漏洞 — SoliClub | 9.1AI | Critical AI | 2024-09-12 |
| CVE-2024-3305 | Utarit SoliClub 信息泄露漏洞 — SoliClub | 7.5AI | High AI | 2024-09-12 |
| CVE-2024-45786 | Reedos aiM-Star 安全漏洞 — Mutual Fund Distribution Product (aiM-Star) | 6.5AI | Medium AI | 2024-09-11 |
| CVE-2023-44254 | Fortinet FortiAnalyzer和FortiManager 安全漏洞 — FortiAnalyzer | 4.7 | Medium | 2024-09-10 |
| CVE-2024-45032 | Siemens Industrial Edge Management 安全漏洞 — Industrial Edge Management Pro | 10.0 | Critical | 2024-09-10 |
| CVE-2024-8601 | TechExcel Back Office Software 安全漏洞 — Back Office Software | 6.5AI | Medium AI | 2024-09-09 |
| CVE-2024-8428 | WordPress plugin ForumWP 安全漏洞 — ForumWP – Forum & Discussion Board | 8.8 | High | 2024-09-06 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 2041 条 CVE 漏洞。