CWE-862 授权机制缺失 类弱点 8300 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-8632 | WordPress plugin KB Support 安全漏洞 — KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin | 6.5 | Medium | 2024-10-01 |
| CVE-2024-8548 | WordPress plugin KB Support 安全漏洞 — KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin | 8.1 | High | 2024-10-01 |
| CVE-2024-9189 | WordPress plugin EU/UK VAT Manager for WooCommerce 安全漏洞 — EU/UK VAT Validation Manager for WooCommerce | 5.3 | Medium | 2024-09-28 |
| CVE-2024-9202 | Eclipse Dataspace Components 安全漏洞 — Eclipse Dataspace Components | 4.3AI | Medium AI | 2024-09-27 |
| CVE-2024-8771 | WordPress plugin Email Subscribers by Icegram Express 安全漏洞 — Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | 4.3 | Medium | 2024-09-26 |
| CVE-2024-47337 | WordPress plugin Joy Of Text Lite 安全漏洞 — Joy Of Text Lite | 4.3 | Medium | 2024-09-26 |
| CVE-2024-9025 | WordPress plugin Sight 安全漏洞 — Sight – Professional Image Gallery and Portfolio | 5.3 | Medium | 2024-09-26 |
| CVE-2024-47330 | WordPress plugin Social Share Buttons by Supsystic 安全漏洞 — Slider by Supsystic | 4.3 | Medium | 2024-09-26 |
| CVE-2024-8552 | WordPress plugin Download Monitor 安全漏洞 — Download Monitor | 4.3 | Medium | 2024-09-26 |
| CVE-2024-8678 | WordPress plugin Revolut Gateway for WooCommerce 安全漏洞 — Revolut Gateway for WooCommerce | 5.3 | Medium | 2024-09-25 |
| CVE-2024-8658 | WordPress plugin myCred 安全漏洞 — Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | 5.3 | Medium | 2024-09-25 |
| CVE-2024-8350 | WordPress plugin Uncanny Groups for LearnDash 安全漏洞 — Uncanny Groups for LearnDash | 2.7 | Low | 2024-09-25 |
| CVE-2024-8349 | WordPress plugin Uncanny Groups for LearnDash 安全漏洞 — Uncanny Groups for LearnDash | 7.2 | High | 2024-09-25 |
| CVE-2024-7491 | WordPress plugin HUSKY 安全漏洞 — HUSKY – Products Filter Professional for WooCommerce | 5.3 | Medium | 2024-09-25 |
| CVE-2024-6590 | WordPress plugin Spreadsheet Integration 安全漏洞 — WPGSI: Spreadsheet Integration | 6.3 | Medium | 2024-09-25 |
| CVE-2024-8434 | WordPress plugin ThemeHunk 安全漏洞 — Easy Mega Menu for WordPress – ThemeHunk | 4.3 | Medium | 2024-09-25 |
| CVE-2024-8437 | WordPress plugin WP Easy Gallery 安全漏洞 — WP Easy Gallery – WordPress Gallery Plugin | 4.3 | Medium | 2024-09-24 |
| CVE-2024-8432 | WordPress plugin Webba Booking 安全漏洞 — Easy Appointment Booking & Scheduling System – Webba Booking Calendar | 4.3 | Medium | 2024-09-24 |
| CVE-2024-7888 | WordPress plugin Classified Listing 安全漏洞 — Classified Listing – AI-Powered Classified ads & Business Directory Plugin | 6.3 | Medium | 2024-09-13 |
| CVE-2024-4660 | GitLab 安全漏洞 — GitLab | 6.5 | Medium | 2024-09-12 |
| CVE-2024-7727 | WordPress plugin HTML5 Video Player 安全漏洞 — HTML5 Video Player – Embed and Play Videos in Custom Player | 5.3 | Medium | 2024-09-11 |
| CVE-2024-7721 | WordPress plugin HTML5 Video Player 安全漏洞 — HTML5 Video Player – Embed and Play Videos in Custom Player | 4.3 | Medium | 2024-09-11 |
| CVE-2024-45591 | XWiki Platform 安全漏洞 — xwiki-platform | 5.3 | Medium | 2024-09-10 |
| CVE-2024-45393 | Computer Vision Annotation Tool 安全漏洞 — cvat | 6.4 | Medium | 2024-09-10 |
| CVE-2024-8369 | WordPress plugin EventPrime 安全漏洞 — EventPrime – Events Calendar, Bookings and Tickets | 5.3 | Medium | 2024-09-10 |
| CVE-2024-45285 | SAP NetWeaver Application Server 安全漏洞 — SAP NetWeaver Application Server for ABAP and ABAP Platform | 5.4 | Medium | 2024-09-10 |
| CVE-2024-45284 | SAP Student Life Cycle Management 安全漏洞 — SAP Student Life Cycle Management (SLcM) | 2.4 | Low | 2024-09-10 |
| CVE-2024-44117 | SAP NetWeaver Application Server 安全漏洞 — SAP NetWeaver Application Server for ABAP and ABAP Platform | 5.4 | Medium | 2024-09-10 |
| CVE-2024-44112 | SAP for Oil & Gas 安全漏洞 — SAP for Oil & Gas | 4.3 | Medium | 2024-09-10 |
| CVE-2024-41728 | SAP NetWeaver Application Server 安全漏洞 — SAP NetWeaver Application Server for ABAP and ABAP Platform | 2.7 | Low | 2024-09-10 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8300 条 CVE 漏洞。