CWE-862 授权机制缺失 类弱点 7360 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-12975 | WordPress plugin CTX Feed – WooCommerce Product Feed Manager 安全漏洞 — Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels | 7.2 | High | 2026-02-19 |
| CVE-2025-13930 | WordPress plugin Checkout Field Manager (Checkout Manager) for WooCommerce 安全漏洞 — Checkout Field Manager (Checkout Manager) for WooCommerce | 5.3 | Medium | 2026-02-19 |
| CVE-2025-15041 | WordPress plugin BackWPup – WordPress Backup & Restore Plugin 安全漏洞 — BackWPup – WordPress Backup & Restore Plugin | 7.2 | High | 2026-02-19 |
| CVE-2025-12081 | WordPress plugin ACF Photo Gallery Field 安全漏洞 — ACF Photo Gallery Field | 4.3 | Medium | 2026-02-19 |
| CVE-2025-12845 | WordPress plugin Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 安全漏洞 — Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | 8.8 | High | 2026-02-19 |
| CVE-2025-11754 | WordPress plugin GDPR Cookie Consent 安全漏洞 — Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | 7.5 | High | 2026-02-19 |
| CVE-2025-11725 | WordPress plugin Aruba HiSpeed Cache 安全漏洞 — Aruba HiSpeed Cache | 6.5 | Medium | 2026-02-19 |
| CVE-2025-12027 | WordPress plugin Mesmerize Companion 安全漏洞 — Mesmerize Companion | 4.3 | Medium | 2026-02-19 |
| CVE-2026-25242 | Gogs 安全漏洞 — gogs | 9.8 | - | 2026-02-19 |
| CVE-2019-25351 | Centova Cast 安全漏洞 — Centova Cast | 8.8 | High | 2026-02-18 |
| CVE-2026-27181 | MajorDoMo 安全漏洞 — MajorDoMo | 7.5 | High | 2026-02-18 |
| CVE-2026-1355 | GitHub Enterprise Server 安全漏洞 — Enterprise Server | 7.3 | - | 2026-02-18 |
| CVE-2026-1942 | WordPress plugin Blog2Social: Social Media Auto Post & Scheduler 安全漏洞 — Blog2Social: Social Media Auto Post & Scheduler | 6.5 | Medium | 2026-02-18 |
| CVE-2026-1656 | WordPress plugin Business Directory Plugin 安全漏洞 — Business Directory Plugin – Easy Listing Directories for WordPress | 5.3 | Medium | 2026-02-18 |
| CVE-2026-2127 | WordPress plugin SiteOrigin Widgets Bundle 安全漏洞 — SiteOrigin Widgets Bundle | 5.4 | Medium | 2026-02-18 |
| CVE-2026-1831 | WordPress plugin YayMail - WooCommerce Email Customizer 安全漏洞 — YayMail – WooCommerce Email Customizer | 2.7 | Low | 2026-02-18 |
| CVE-2026-1860 | WordPress plugin Kali Forms 安全漏洞 — Kali Forms — Contact Form & Drag-and-Drop Builder | 4.3 | Medium | 2026-02-18 |
| CVE-2026-1655 | WordPress plugin EventPrime 安全漏洞 — EventPrime – Events Calendar, Bookings and Tickets | 4.3 | Medium | 2026-02-18 |
| CVE-2026-1938 | WordPress plugin YayMail – WooCommerce Email Customizer 安全漏洞 — YayMail – WooCommerce Email Customizer | 5.3 | Medium | 2026-02-18 |
| CVE-2026-2633 | WordPress plugin Gutenberg Blocks with AI by Kadence WP 安全漏洞 — Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | 4.3 | Medium | 2026-02-18 |
| CVE-2026-1640 | WordPress plugin Taskbuilder – WordPress Project Management & Task Management 安全漏洞 — Taskbuilder – Project Management & Task Management Tool With Kanban Board | 4.3 | Medium | 2026-02-18 |
| CVE-2026-1937 | WordPress plugin YayMail – WooCommerce Email Customizer 安全漏洞 — YayMail – WooCommerce Email Customizer | 7.2 | High | 2026-02-18 |
| CVE-2025-12356 | WordPress plugin Tickera – Sell Tickets & Manage Events 安全漏洞 — Tickera – Sell Tickets & Manage Events | 4.3 | Medium | 2026-02-18 |
| CVE-2026-1906 | WordPress plugin PDF Invoices & Packing Slips for WooCommerce 安全漏洞 — PDF Invoices & Packing Slips for WooCommerce | 4.3 | Medium | 2026-02-18 |
| CVE-2026-1925 | WordPress plugin EmailKit – Email Customizer for WooCommerce & WP 安全漏洞 — EmailKit – Email Customizer for WooCommerce & WP | 4.3 | Medium | 2026-02-18 |
| CVE-2025-12075 | WordPress plugin Order Splitter for WooCommerce 安全漏洞 — Order Splitter for WooCommerce | 4.3 | Medium | 2026-02-18 |
| CVE-2024-31118 | WordPress plugin SP Project & Document Manager 安全漏洞 — SP Project & Document Manager | 6.5 | Medium | 2026-02-17 |
| CVE-2022-41650 | WordPress plugin Custom Content by Country (by Shield Security) 安全漏洞 — Custom Content by Country (by Shield Security) | 6.5 | Medium | 2026-02-17 |
| CVE-2026-2608 | WordPress plugin Kadence Blocks — Page Builder Toolkit for Gutenberg Editor 安全漏洞 — Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | 4.3 | Medium | 2026-02-17 |
| CVE-2026-25903 | Apache NiFi 安全漏洞 — Apache NiFi | 6.5AI | Medium AI | 2026-02-17 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 7360 条 CVE 漏洞。