CWE-862 授权机制缺失 类弱点 7360 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-13313 | WordPress plugin CRM Memberships 安全漏洞 — CRM Memberships | 9.8 | Critical | 2025-12-05 |
| CVE-2025-54159 | Synology BeeDrive 安全漏洞 — BeeDrive for desktop | 7.5 | High | 2025-12-04 |
| CVE-2025-2848 | Synology Mail Server 安全漏洞 — Synology Mail Server | 6.3 | Medium | 2025-12-04 |
| CVE-2025-12826 | WordPress plugin Custom Post Type UI 安全漏洞 — Custom Post Type UI | 4.8 | Medium | 2025-12-04 |
| CVE-2025-12782 | WordPress plugin Beaver Builder – WordPress Page Builder 安全漏洞 — Beaver Builder Page Builder – Drag and Drop Website Builder | 4.3 | Medium | 2025-12-04 |
| CVE-2025-13756 | WordPress plugin Fluent Booking 安全漏洞 — Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | 4.3 | Medium | 2025-12-03 |
| CVE-2025-13354 | WordPress plugin Tag Category and Taxonomy Manager 安全漏洞 — Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI | 4.3 | Medium | 2025-12-03 |
| CVE-2025-13342 | WordPress plugin Frontend Admin by DynamiApps 安全漏洞 — Frontend Admin by DynamiApps | 9.8 | Critical | 2025-12-03 |
| CVE-2025-12887 | WordPress plugin Post SMTP 安全漏洞 — Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 5.4 | Medium | 2025-12-03 |
| CVE-2025-13472 | Perforce BlazeMeter Jenkins Plugin 安全漏洞 — BlazeMeter | 4.3AI | Medium AI | 2025-12-03 |
| CVE-2025-10304 | WordPress plugin Everest Backup 安全漏洞 — Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 5.3 | Medium | 2025-12-03 |
| CVE-2025-13828 | Mautic 安全漏洞 — Mautic | 7.8AI | High AI | 2025-12-02 |
| CVE-2025-41012 | TCMAN GIM 安全漏洞 — GIM | 7.5AI | High AI | 2025-12-02 |
| CVE-2025-11726 | WordPress plugin Beaver Builder 安全漏洞 — Beaver Builder Page Builder – Drag and Drop Website Builder | 4.3 | Medium | 2025-12-02 |
| CVE-2025-13813 | Mogu blog 安全漏洞 — Mogu Blog v2 | 5.6 | Medium | 2025-12-01 |
| CVE-2025-65112 | PubNet 安全漏洞 — PubNet | 9.4 | Critical | 2025-11-29 |
| CVE-2025-10476 | WordPress plugin WP Fastest Cache 安全漏洞 — WP Fastest Cache – WordPress Cache Plugin | 4.3 | Medium | 2025-11-27 |
| CVE-2025-13381 | WordPress plugin AI ChatBot with ChatGPT and Content Generator by AYS 安全漏洞 — AI ChatBot with ChatGPT and Content Generator by AYS | 5.3 | Medium | 2025-11-27 |
| CVE-2025-13441 | WordPress plugin Hide Category by User Role for WooCommerce 安全漏洞 — Hide Category by User Role for WooCommerce | 5.3 | Medium | 2025-11-27 |
| CVE-2025-12579 | WordPress plugin Reuters Direct 安全漏洞 — Reuters Direct | 5.3 | Medium | 2025-11-27 |
| CVE-2025-12634 | WordPress plugin Refund Request for WooCommerce 安全漏洞 — Refund Request for WooCommerce | 4.3 | Medium | 2025-11-25 |
| CVE-2025-13405 | WordPress plugin Ace Post Type Builder 安全漏洞 — Ace Post Type Builder | 5.3 | Medium | 2025-11-25 |
| CVE-2025-13404 | WordPress plugin atec Duplicate Page & Post 安全漏洞 — atec Duplicate Page & Post | 5.3 | Medium | 2025-11-25 |
| CVE-2025-13386 | WordPress plugin Social Images Widget 安全漏洞 — Social Images Widget | 5.3 | Medium | 2025-11-25 |
| CVE-2025-13414 | WordPress plugin Chamber Dashboard Business Directory 安全漏洞 — Chamber Dashboard Business Directory | 5.3 | Medium | 2025-11-25 |
| CVE-2025-12043 | WordPress plugin Autochat Automatic Conversation 安全漏洞 — Autochat Automatic Conversation | 5.3 | Medium | 2025-11-25 |
| CVE-2025-13643 | MongoDB Server 安全漏洞 — MongoDB Server | 3.1 | Low | 2025-11-25 |
| CVE-2025-13558 | WordPress plugin Blog2Social: Social Media Auto Post & Scheduler 安全漏洞 — Blog2Social: Social Media Auto Post & Scheduler | 5.4 | Medium | 2025-11-25 |
| CVE-2025-10646 | WordPress plugin Search Exclude 安全漏洞 — Search Exclude | 4.3 | Medium | 2025-11-25 |
| CVE-2025-41017 | Davantis DFUSION 安全漏洞 — DFUSION | 5.3AI | Medium AI | 2025-11-24 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 7360 条 CVE 漏洞。