目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-99 对资源描述符的控制不恰当(资源注入) 类漏洞列表 72

CWE-99 对资源描述符的控制不恰当(资源注入) 类弱点 72 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-99 属于资源注入漏洞，指程序未充分校验上游输入，直接将其用作外部资源标识符。攻击者通常通过构造恶意输入，操纵资源访问路径以读取或修改非授权文件、数据库记录等敏感数据。开发者应避免此问题，需对输入进行严格的白名单验证，使用参数化查询或安全API，确保资源标识符在预期控制范围内，从而阻断非法访问。

MITRE CWE 官方描述
CWE：CWE-99 资源标识符控制不当（'Resource Injection'） 英文：产品从上游组件接收输入，但在将其用作可能超出预期控制范围的资源的标识符之前，未对输入进行限制或限制不正确。 当满足以下两个条件时，会发生资源注入（Resource Injection）问题：攻击者可以指定用于访问系统资源的标识符。例如，攻击者可能能够指定要打开的文件名的一部分或要使用的端口号。通过指定资源，攻击者获得了原本不被允许的能力。例如，程序可能赋予攻击者覆盖指定文件、使用由攻击者控制的配置运行或将敏感信息传输到第三方服务器的能力。这可能使攻击者能够访问或修改原本受保护的系统资源。
常见影响 (1)
Confidentiality, Integrity Read Application Data, Modify Application Data, Read Files or Directories, Modify Files or Directories
An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information.
缓解措施 (1)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
The following Java code uses input from an HTTP request to create a file name. The programmer has not considered the possibility that an attacker could provide a file name such as "../../tomcat/conf/server.xml", which causes the application to delete one of its own configuration files.
String rName = request.getParameter("reportName"); File rFile = new File("/usr/local/apfr/reports/" + rName); ... rFile.delete();
Bad · Java
The following code uses input from the command line to determine which file to open and echo back to the user. If the program runs with privileges and malicious users can create soft links to the file, they can use the program to read the first part of any file on the system.
ifstream ifs(argv[0]); string s; ifs >> s; cout << s;
Bad · C++
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-71901 Apache OFBiz SFA 组件任意内部服务调用漏洞 — Apache OFBiz - - 2026-11-05
CVE-2026-110283 IBM Db2 Genius Hub 多个安全漏洞 — Db2 Genius Hub 4.3 Medium 2026-11-04
CVE-2026-114726 Roundcube 1.6.20/1.7.5 前邮件头注入漏洞 — Webmail 5.8 Medium 2026-10-22
CVE-2026-114725 Roundcube 1.6.20/1.7.5 邮件头注入漏洞 — Webmail 5.0 Medium 2026-10-22
CVE-2026-114717 Roundcube 1.6.20/1.7.5 邮件头注入漏洞 — Webmail 4.0 Medium 2026-10-22
CVE-2026-114716 Roundcube 1.6.x/1.7.x 邮件头注入漏洞 — Webmail 8.5 High 2026-10-22
CVE-2026-50218 Akamai GPA <7.4 JWT验证绕过漏洞 — Guardicore Platform Agent 8.5 High 2026-10-14
CVE-2026-107448 Magic:TheGatheringArena存在URL跳转漏洞 — Magic: The Gathering Arena 3.4 Low 2026-10-08
CVE-2026-106583 OpenSSH < 10.6 SSH命令注入漏洞 — OpenSSH 2.5 Low 2026-10-06
CVE-2026-105444 dotnet eShop Ordering API GetOrderAsync 资源注入漏洞 — eShop 6.3 Medium 2026-10-05
CVE-2026-100884 Krayin Laravel-CRM attachment-download 端点 ACL 资源注入漏洞 — laravel-crm 4.3 Medium 2026-09-27
CVE-2026-95847 Moquette客户端ID导致跨会话H2队列损坏 — moquette 8.8 High 2026-09-23
CVE-2026-94149 Omega Solution HRM OS 权限资源注入漏洞 — HRM OS 4.3 Medium 2026-09-21
CVE-2026-3855 GitLab 资源标识符控制不当漏洞 — GitLab 3.1 Low 2026-09-16
CVE-2026-81524 MongoDB mongo-c-driver 输入验证错误漏洞 — C Driver 5.4 Medium 2026-08-27
CVE-2026-81521 MongoDB go driver 输入验证错误漏洞 — GO Driver 6.5 Medium 2026-08-27
CVE-2026-62910 Microsoft Exchange Server 输入验证错误漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 7.2 High 2026-08-11
CVE-2026-15186 macrozheng mall 输入验证错误漏洞 — mall 6.3 Medium 2026-07-09
CVE-2026-13493 AIDC-AI ComfyUI-Copilot 输入验证错误漏洞 — ComfyUI-Copilot 3.1 Low 2026-06-28
CVE-2026-12207 medkey-org medkey 输入验证错误漏洞 — medkey 4.3 Medium 2026-06-15
CVE-2026-10624 SourceCodester Human Resource Management 安全漏洞 — Human Resource Management 4.3 Medium 2026-06-02
CVE-2026-10299 Code-Projects Online Hospital Management System 安全漏洞 — Online Hospital Management System 3.8 Low 2026-06-01
CVE-2026-10168 School Student Management System 安全漏洞 — School Student Management System 6.3 Medium 2026-05-31
CVE-2026-9438 Student Management System 安全漏洞 — StudentManagementSystem 5.4 Medium 2026-05-25
CVE-2026-33603 Open-Xchange OX Dovecot Pro 安全漏洞 — OX Dovecot Pro 6.8 Medium 2026-05-12
CVE-2026-7303 XXL-JOB 安全漏洞 — xxl-job 3.7 Low 2026-04-28
CVE-2026-5414 Newgen OmniDocs 安全漏洞 — OmniDocs 5.3 Medium 2026-04-02
CVE-2026-5031 BichitroGan ISP Billing Software 安全漏洞 — ISP Billing Software 4.3 Medium 2026-03-29
CVE-2026-3693 AgentChat 安全漏洞 — AgentChat 7.3 High 2026-03-08
CVE-2025-12919 EverShop 安全漏洞 — EverShop 3.7 Low 2025-11-09

CWE-99（对资源描述符的控制不恰当(资源注入)） 是常见的弱点类别，本平台收录该类弱点关联的 72 条 CVE 漏洞。