CWE-862 授权机制缺失 类弱点 8296 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-32574 | WordPress plugin Injection Guard 安全漏洞 — Injection Guard | 4.3 | Medium | 2024-12-13 |
| CVE-2023-32519 | WordPress plugin WCP Contact Form 安全漏洞 — WCP Contact Form | 4.3 | Medium | 2024-12-13 |
| CVE-2023-32520 | WordPress plugin WCP Contact Form 安全漏洞 — WCP Contact Form | 7.5 | High | 2024-12-13 |
| CVE-2023-32506 | WordPress plugin Link Whisper Free 安全漏洞 — Link Whisper Free | 6.5 | Medium | 2024-12-13 |
| CVE-2023-32507 | WordPress plugin Woo Custom Emails 安全漏洞 — Woo Custom Emails | 7.3 | High | 2024-12-13 |
| CVE-2023-30490 | WordPress plugin Easing Slider 安全漏洞 — Easing Slider | 7.5 | High | 2024-12-13 |
| CVE-2023-28990 | WordPress plugin Viral Mag 安全漏洞 — Viral Mag | 4.3 | Medium | 2024-12-13 |
| CVE-2023-27456 | WordPress plugin Total 安全漏洞 — Total | 4.3 | Medium | 2024-12-13 |
| CVE-2023-25988 | WordPress plugin Video Gallery – YouTube Gallery 安全漏洞 — Video Gallery – YouTube Gallery | 7.5 | High | 2024-12-13 |
| CVE-2022-47429 | 编号已被CVE保留 — Coming Soon Landing Page and Maintenance Mode WordPress Plugin | 5.3 | Medium | 2024-12-13 |
| CVE-2022-44578 | Wordpress plugin Owl Carousel 安全漏洞 — Owl Carousel | 5.3 | Medium | 2024-12-13 |
| CVE-2023-22697 | WordPress plugin Survey Maker 安全漏洞 — Survey Maker | 5.3 | Medium | 2024-12-13 |
| CVE-2022-47594 | 编号已被CVE保留 — Essential Blocks for Gutenberg | 6.5 | Medium | 2024-12-13 |
| CVE-2022-47182 | 编号已被CVE保留 — APIExperts Square for WooCommerce | 5.3 | Medium | 2024-12-13 |
| CVE-2022-47176 | 编号已被CVE保留 — Depicter Slider | 4.3 | Medium | 2024-12-13 |
| CVE-2022-47168 | 编号已被CVE保留 — Printful Integration for WooCommerce | 4.3 | Medium | 2024-12-13 |
| CVE-2022-46846 | 编号已被CVE保留 — Trending/Popular Post Slider and Widget | 5.3 | Medium | 2024-12-13 |
| CVE-2022-46840 | 编号已被CVE保留 — JS Help Desk – Best Help Desk & Support Plugin | 5.4 | Medium | 2024-12-13 |
| CVE-2022-46838 | 编号已被CVE保留 — JS Help Desk – Best Help Desk & Support Plugin | 9.1 | Critical | 2024-12-13 |
| CVE-2022-46811 | 编号已被CVE保留 — ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | 4.3 | Medium | 2024-12-13 |
| CVE-2022-46807 | 编号已被CVE保留 — Stock Sync for WooCommerce | 4.3 | Medium | 2024-12-13 |
| CVE-2022-46796 | 编号已被CVE保留 — CURCY | 6.5 | Medium | 2024-12-13 |
| CVE-2022-46795 | 编号已被CVE保留 — Print Invoice & Delivery Notes for WooCommerce | 6.5 | Medium | 2024-12-13 |
| CVE-2022-45840 | Wordpress plugin Auto Affiliate Links 安全漏洞 — Auto Affiliate Links | 6.5 | Medium | 2024-12-13 |
| CVE-2022-45841 | WordPress plugin Robo Gallery 安全漏洞 — Robo Gallery | 5.4 | Medium | 2024-12-13 |
| CVE-2022-45826 | WordPress plugin Sunshine Photo Cart 安全漏洞 — Sunshine Photo Cart | 5.4 | Medium | 2024-12-13 |
| CVE-2022-45819 | WordPress plugin Popup Maker 安全漏洞 — Popup Maker | 3.5 | Low | 2024-12-13 |
| CVE-2022-45806 | WordPress plugin Formidable Forms 安全漏洞 — Formidable Forms | 4.3 | Medium | 2024-12-13 |
| CVE-2022-43472 | WordPress plugin eRoom – Zoom Meetings & Webinar 安全漏洞 — eRoom – Zoom Meetings & Webinar | 4.3 | Medium | 2024-12-13 |
| CVE-2024-10783 | WordPress plugin MainWP Child 安全漏洞 — MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | 8.1 | High | 2024-12-13 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8296 条 CVE 漏洞。