目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-915 类漏洞列表 60

CWE-915 类弱点 60 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-915属于对象属性控制不当漏洞，指程序接收上游输入以初始化或更新对象属性时，未严格限制可修改的字段。攻击者常利用此缺陷篡改内部敏感属性，如权限标志或状态位，从而绕过安全校验或提升权限。开发者应实施严格的白名单机制，仅允许修改预期的公开属性，并对所有动态输入进行严格的类型和范围校验，确保内部属性不可被外部直接操控。

MITRE CWE 官方描述
CWE：CWE-915 对动态确定的对象属性的控制不当 英文：产品从上游组件接收输入，该输入指定了要在对象中初始化或更新的多个属性、特性或字段，但产品未能正确控制哪些属性可以被修改。 如果对象包含仅打算用于内部使用的属性，那么对这些属性的意外修改可能导致漏洞。这种弱点有时也被称为使其成为可能的特定于语言的机制，例如批量赋值（mass assignment）、自动绑定（autobinding）或对象注入（object injection）。
常见影响 (3)
IntegrityModify Application Data
An attacker could modify sensitive data or program variables.
IntegrityExecute Unauthorized Code or Commands
Other, IntegrityVaries by Context, Alter Execution Logic
缓解措施 (4)
ImplementationIf available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists. For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
Architecture and Design, ImplementationIf available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
ImplementationFor any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
Implementation, Architecture and DesignRefactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
代码示例 (1)
This function sets object attributes based on a dot-separated path.
function setValueByPath (object, path, value) { const pathArray = path.split("."); const attributeToSet = pathArray.pop(); let objectToModify = object; for (const attr of pathArray) { if (typeof objectToModify[attr] !== 'object') { objectToModify[attr] = {}; } objectToModify = objectToModify[attr]; } objectToModify[attributeToSet] = value; return object; }
Bad · JavaScript
setValueByPath({}, "__proto__.isAdmin", true) setValueByPath({}, "constructor.prototype.isAdmin", true)
Bad · JavaScript
CVE ID标题CVSS风险等级Published
CVE-2026-48150 Budibase 安全漏洞 — budibase 9.0 Critical2026-05-27
CVE-2026-8327 Concrete CMS 安全漏洞 — Concrete CMS--2026-05-21
CVE-2026-6366 Drupal core 安全漏洞 — Drupal core--2026-05-19
CVE-2026-46721 TYPO3 Extension Frontend User Registration 安全漏洞 — Extension "Frontend User Registration"--2026-05-19
CVE-2026-45396 Open WebUI 安全漏洞 — open-webui 5.4 Medium2026-05-15
CVE-2026-45229 quark-auto-save 安全漏洞 — quark-auto-save 8.8 High2026-05-13
CVE-2025-14341 DivvyDrive 安全漏洞 — DivvyDrive 8.3 High2026-05-07
CVE-2026-41139 mathjs 安全漏洞 — mathjs 6.1 -2026-05-07
CVE-2026-33453 Apache Camel 安全漏洞 — Apache Camel 9.8AICriticalAI2026-04-27
CVE-2026-42044 Axios 安全漏洞 — axios 6.5 Medium2026-04-24
CVE-2026-40897 mathjs 安全漏洞 — mathjs 8.8 High2026-04-24
CVE-2026-6912 AWS Ops Wheel 安全漏洞 — AWS Ops Wheel 8.8 High2026-04-24
CVE-2026-34427 Vvveb 安全漏洞 — Vvveb 8.8 High2026-04-20
CVE-2026-40486 kimai 安全漏洞 — kimai 4.3 Medium2026-04-17
CVE-2026-34179 LXD 安全漏洞 — lxd 9.1 Critical2026-04-09
CVE-2026-5708 Amazon Web Services Research and Engineering Studio 安全漏洞 — Research and Engineering Studio (RES) 8.8 High2026-04-06
CVE-2026-5251 admin 安全漏洞 — admin 6.3 Medium2026-04-01
CVE-2026-5248 gougucms 安全漏洞 — gougucms 6.3 Medium2026-04-01
CVE-2026-34406 APTRS 安全漏洞 — APTRS 8.8 -2026-03-31
CVE-2026-27953 ormar 安全漏洞 — ormar 7.1 High2026-03-19
CVE-2026-32742 Parse Server 安全漏洞 — parse-server 4.3 Medium2026-03-18
CVE-2026-29056 Kanboard 安全漏洞 — kanboard 8.8 -2026-03-18
CVE-2026-32640 simpleeval 安全漏洞 — simpleeval 7.5AIHighAI2026-03-13
CVE-2026-30822 Flowise 安全漏洞 — Flowise 5.3 -2026-03-07
CVE-2025-15602 Snipe-IT 安全漏洞 — Snipe-IT 8.8 High2026-03-06
CVE-2026-28219 Discourse 安全漏洞 — discourse 4.3AIMediumAI2026-02-26
CVE-2026-27125 Svelte 安全漏洞 — svelte 3.7 -2026-02-20
CVE-2026-24140 MyTube 安全漏洞 — MyTube 2.7 Low2026-01-23
CVE-2026-22814 @adonisjs/lucid 安全漏洞 — lucid 7.5AIHighAI2026-01-13
CVE-2026-21695 titra 安全漏洞 — titra 4.3 Medium2026-01-07

CWE-915 是常见的弱点类别，本平台收录该类弱点关联的 60 条 CVE 漏洞。