CWE-639 通过用户控制密钥绕过授权机制 类弱点 2041 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-4154 | Lunary 安全漏洞 — lunary-ai/lunary | 7.1AI | High AI | 2024-05-21 |
| CVE-2024-4151 | Lunary 访问控制错误漏洞 — lunary-ai/lunary | 7.1AI | High AI | 2024-05-20 |
| CVE-2024-4843 | Trellix ePolicy Orchestrator 安全漏洞 — ePolicy Orchestrator | 4.3 | Medium | 2024-05-16 |
| CVE-2024-4279 | WordPress plugin Tutor LMS 安全漏洞 — Tutor LMS – eLearning and online course solution | 6.5 | Medium | 2024-05-16 |
| CVE-2023-40720 | Fortinet FortiVoice 安全漏洞 — FortiVoice | 6.7 | High | 2024-05-14 |
| CVE-2024-1693 | WordPress plugin SP Project & Document Manager 安全漏洞 — SP Project & Document Manager | 4.3 | Medium | 2024-05-09 |
| CVE-2024-4538 | Janto Ticketing 安全漏洞 — Janto Ticketing Software | 7.5 | High | 2024-05-07 |
| CVE-2024-4537 | Janto Ticketing 安全漏洞 — Janto Ticketing Software | 7.5 | High | 2024-05-07 |
| CVE-2024-34383 | WordPress plugin SEOPress 安全漏洞 — SEOPress | 5.3 | Medium | 2024-05-06 |
| CVE-2024-2346 | WordPress plugin FileBird 安全漏洞 — FileBird – WordPress Media Library Folders & File Manager | 5.4 | Medium | 2024-05-02 |
| CVE-2024-33542 | WordPress plugin Crelly Slider 安全漏洞 — Crelly Slider | 4.3 | Medium | 2024-04-29 |
| CVE-2024-32772 | WordPress plugin ProfileGrid 安全漏洞 — ProfileGrid | 4.3 | Medium | 2024-04-24 |
| CVE-2024-32808 | WordPress plugin ProfileGrid 安全漏洞 — ProfileGrid | 5.4 | Medium | 2024-04-24 |
| CVE-2024-32823 | WordPress plugin Rate My Post 安全漏洞 — Rate my Post – WP Rating System | 5.3 | Medium | 2024-04-24 |
| CVE-2024-32683 | WordPress Plugin Wp Ultimate Review 安全漏洞 — Wp Ultimate Review | 5.3 | Medium | 2024-04-19 |
| CVE-2023-6897 | WordPress Plugin EAN for WooCommerce 安全漏洞 — EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory | 4.3 | Medium | 2024-04-18 |
| CVE-2024-32604 | WordPress Plugin WP-Recall 安全漏洞 — WP-Recall | 4.3 | Medium | 2024-04-18 |
| CVE-2024-1626 | Lunary 安全漏洞 — lunary-ai/lunary | 4.3 | - | 2024-04-16 |
| CVE-2023-45808 | iTop 安全漏洞 — iTop | 4.1 | Medium | 2024-04-15 |
| CVE-2024-22439 | Hewlett Packard Enterprise FlexFabric 和 FlexNetwork 安全漏洞 — HPE FlexNetwork and FlexFabric products | 6.9 | Medium | 2024-04-15 |
| CVE-2024-1625 | lunary 安全漏洞 — lunary-ai/lunary | 5.3AI | Medium AI | 2024-04-10 |
| CVE-2024-0872 | WordPress Plugin Watu Quiz 安全漏洞 — Watu Quiz | 4.3 | Medium | 2024-04-09 |
| CVE-2024-2543 | WordPress Plugin Permalink 安全漏洞 — Permalink Manager Lite | 4.3 | Medium | 2024-04-09 |
| CVE-2024-2261 | WordPress Plugin Event Tickets and Registration 安全漏洞 — Event Tickets and Registration | 4.3 | Medium | 2024-04-09 |
| CVE-2023-6317 | LG webOS 安全漏洞 — WebOS | 7.2 | High | 2024-04-09 |
| CVE-2024-31291 | WordPress Plugin ProfileGrid 安全漏洞 — ProfileGrid | 4.3 | Medium | 2024-04-07 |
| CVE-2024-31296 | WordPress Plugin BookingPress 安全漏洞 — BookingPress | 4.3 | Medium | 2024-04-07 |
| CVE-2023-6523 | ExtremePacs Extreme XDS 安全漏洞 — Extreme XDS | 8.8 | High | 2024-04-05 |
| CVE-2024-30543 | WordPress Plugin Whizzy 安全漏洞 — Whizzy | 6.5 | Medium | 2024-03-31 |
| CVE-2024-31095 | WordPress Plugin Thumbs Rating 安全漏洞 — Thumbs Rating | 5.3 | Medium | 2024-03-31 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 2041 条 CVE 漏洞。