CWE-862 授权机制缺失 类弱点 7360 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-62883 | WordPress plugin Premmerce User Roles 安全漏洞 — Premmerce User Roles | 4.3 | Medium | 2025-10-27 |
| CVE-2025-62884 | WordPress plugin Coupon Affiliates 安全漏洞 — Coupon Affiliates | 5.3 | Medium | 2025-10-27 |
| CVE-2025-62882 | WordPress plugin Seriously Simple Podcasting 安全漏洞 — Seriously Simple Podcasting | 4.3 | Medium | 2025-10-27 |
| CVE-2025-62881 | WordPress plugin WP-Lister Lite for eBay 安全漏洞 — WP-Lister Lite for eBay | 4.3 | Medium | 2025-10-27 |
| CVE-2025-11989 | GitLab 安全漏洞 — GitLab | 3.7 | Low | 2025-10-26 |
| CVE-2025-10637 | WordPress plugin Social Feed Gallery 安全漏洞 — Social Feed Gallery | 5.3 | Medium | 2025-10-25 |
| CVE-2025-11255 | WordPress plugin Password Policy Manager | Password Manager 安全漏洞 — Password Policy Manager | Password Manager | 4.3 | Medium | 2025-10-25 |
| CVE-2025-10694 | WordPress plugin User Feedback 安全漏洞 — UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds | 5.3 | Medium | 2025-10-25 |
| CVE-2025-11564 | WordPress plugin Tutor LMS 安全漏洞 — Tutor LMS – eLearning and online course solution | 5.3 | Medium | 2025-10-25 |
| CVE-2025-11269 | WordPress plugin Product Filter by WBW 安全漏洞 — Product Filter for WooCommerce by WBW | 5.3 | Medium | 2025-10-25 |
| CVE-2025-10579 | WordPress plugin BackWPup 安全漏洞 — BackWPup – WordPress Backup & Restore Plugin | 5.3 | Medium | 2025-10-25 |
| CVE-2025-62714 | Karmada Dashboard 安全漏洞 — dashboard | 7.5 | - | 2025-10-24 |
| CVE-2025-36361 | IBM App Connect Enterprise 安全漏洞 — App Connect Enterprise | 6.3 | Medium | 2025-10-24 |
| CVE-2025-12134 | WordPress plugin ZoloBlocks 安全漏洞 — ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns | 5.3 | Medium | 2025-10-24 |
| CVE-2025-10749 | WordPress plugin Microsoft Azure Storage 安全漏洞 — Microsoft Azure Storage for WordPress | 5.4 | Medium | 2025-10-24 |
| CVE-2025-11172 | WordPress plugin Check Plagiarism 安全漏洞 — Check Plagiarism | 4.3 | Medium | 2025-10-24 |
| CVE-2025-10901 | WordPress plugin Originality.ai AI Checker 安全漏洞 — Originality.ai AI Checker | 4.3 | Medium | 2025-10-24 |
| CVE-2025-12014 | WordPress plugin NGINX Cache Optimizer 安全漏洞 — NGINX Cache Optimizer | 4.3 | Medium | 2025-10-24 |
| CVE-2025-11257 | WordPress plugin LLM Hubspot Blog Import 安全漏洞 — LLM Hubspot Blog Import | 4.3 | Medium | 2025-10-24 |
| CVE-2025-11887 | WordPress plugin Supervisor 安全漏洞 — Supervisor | 4.3 | Medium | 2025-10-24 |
| CVE-2025-62256 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 4.3AI | Medium AI | 2025-10-23 |
| CVE-2025-62614 | BookLore 安全漏洞 — booklore | 7.5AI | High AI | 2025-10-22 |
| CVE-2025-62247 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 6.5AI | Medium AI | 2025-10-22 |
| CVE-2025-62073 | WordPress plugin MeetingHub 安全漏洞 — MeetingHub | 4.3 | Medium | 2025-10-22 |
| CVE-2025-62070 | WordPress plugin WowRevenue 安全漏洞 — WowRevenue | 4.3 | Medium | 2025-10-22 |
| CVE-2025-62072 | WordPress plugin Front End Users 安全漏洞 — Front End Users | 4.3 | Medium | 2025-10-22 |
| CVE-2025-62071 | WordPress plugin Reviews Widgets for Google & 45+ platforms by Repuso 安全漏洞 — Social proof testimonials and reviews by Repuso | 4.3 | Medium | 2025-10-22 |
| CVE-2025-62052 | WordPress plugin One Page Express Companion 安全漏洞 — One Page Express Companion | 4.3 | Medium | 2025-10-22 |
| CVE-2025-62048 | WordPress plugin SmartCrawl 安全漏洞 — SmartCrawl | 5.4 | Medium | 2025-10-22 |
| CVE-2025-62027 | WordPress plugin Event Tickets 安全漏洞 — Event Tickets | 5.4 | Medium | 2025-10-22 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 7360 条 CVE 漏洞。