漏洞 (CVE)
常見漏洞與暴露
漏洞清單
所有 CVE
CISA - 已被利用漏洞
OWASP - 漏洞
CVE（依類別）
依廠商搜尋
依產品搜尋
依年份排序
CVE 2026
CVE 2025
CVE 統計
CVE（依年份/月份）
CVE（依類別）
CVE（依 OWASP）
CVE（依 CVSS 評分）
漏洞廠商 TOP 100
漏洞產品 TOP 100
特定檢視
CVE 嚴重評分
CVE EPSS > 70%
CVE 高危評分
CVE 網路（向量）
CVE 本機（向量）
CVE 實體（向量）
CVE
CVE（常見漏洞與暴露）是一份公開揭露的電腦安全缺陷清單。
OWASP
OWASP Top 10 是識別並記錄 Web 應用程式十大安全漏洞的倡議。
CISA KEV
CISA 已知被利用漏洞（KEV）是識別並發布已知被利用漏洞清單的倡議。
製造商與產品 (CPE)
廠商與產品
廠商清單
所有廠商
漏洞廠商 TOP 100
產品清單
所有產品
漏洞產品 TOP 100
CPE（通用平台枚舉）是一種用於命名硬體、軟體和作業系統的標準化方案。CPE 提供結構化命名方式，可根據廠商、產品名稱、版本、更新、版次和語言等特定屬性，唯一識別和分類資訊技術系統、平台和套件。
弱點 (CWE)
常見弱點枚舉
CWE 清單
所有 CWE
CWE 檢視
CWE 類別
特定檢視
CWE Top 25（2023）
CWE Top 25（2022）
CWE Top 25（2021）
軟體開發
硬體設計
研究概念
最新 5 個 CWE
CWE-1463
(2026-10-28 00:00 +00:00)
CWE-1462
(2026-10-28 00:00 +00:00)
CWE-1466
(2026-10-28 00:00 +00:00)
CWE-1465
(2026-10-28 00:00 +00:00)
CWE-1464
(2026-10-28 00:00 +00:00)
CWE（常見弱點枚舉）是軟體弱點與漏洞的全面清單和分類體系。它作為描述架構、設計、程式碼或實作中可能導致漏洞的軟體安全弱點的通用語言。
攻擊模式 (CAPEC)
常見攻擊模式枚舉與分類
CAPEC 清單
所有 CAPEC
CAPEC 檢視
CAPEC 類別
特定檢視
攻擊機制
攻擊領域
WASC 威脅分類 2.0
ATT&CK 相關模式
OWASP 相關模式
最新 5 個 CAPEC
CAPEC-701
(2023-01-24 00:00 +00:00)
CAPEC-700
(2023-01-24 00:00 +00:00)
CAPEC-702
(2023-01-24 00:00 +00:00)
CAPEC-699
(2023-01-24 00:00 +00:00)
CAPEC-691
(2022-09-29 00:00 +00:00)
CAPEC（常見攻擊模式枚舉與分類）是一個全面的公開資源，記錄了對手在網路攻擊中使用的常見攻擊模式。此知識庫旨在理解和闡明常見漏洞及攻擊者利用這些漏洞的方法。
服務與價格
價格與授權
建立帳戶
說明與資訊
常見問題與說明
部落格與文章
資料庫合作夥伴
聯絡我們
搜尋：CVE ID、CWE ID、CAPEC ID、廠商或 CVE 關鍵字
最近搜尋：
找不到結果
請嘗試使用不同的查詢詞彙
繁體中文
English
Français
Deutsch
Español
Italiano
Português
Nederlands
Polski
日本語
简体中文
繁體中文
한국어
Bahasa Indonesia
Tiếng Việt
淺色
深色
系統
CVE Find - 提醒系統
隨時掌握最新資訊
建立免費帳戶
開設免費帳戶
登入您的帳戶
管理您的提醒
CVE-2025-31136：詳細資料
首頁
常見漏洞與暴露 (CVE)
CVE-2025-31136：詳細資料
CVE-2025-31136
評分 / 嚴重程度
6.7
/
中危
EPSS
0.23%
V4
發布日期
2025-06-04
19h42
+00:00
類別
Cross-site Scripting
OWASP
A03-Injection
向量
Network
修改日期
2025-06-04
20h18
+00:00
官方連結
CVE.org
NVD
指定 CVE 通知
掌握特定 CVE 的任何變更。
管理通知
自訂提醒
啟用您的個人化提醒！
要啟用提醒，只需登入您的
免費帳戶
即可。若尚未登入，請選擇以下其中一個選項。
登入您的帳戶
建立免費帳戶
指定 CVE 通知
掌握特定 CVE 的任何變更。
發送提醒的條件：與上次提醒比較，CISA、EPSS、CVSS、CWE、解決方案、CPE 有所差異。
參數
您可以指定一個標題，該標題將出現在所有發送的提醒中。
請輸入 CVE ID，例如 CVE-2025-1234
排程
頻率？
需要更高方案
每小時
即時回應新發布的資訊
需要更高方案
每天
在選定日期發送電子郵件
需要更高方案
每週
在選定日期發送摘要
每個月
每月摘要
小時
每小時
每 15 分鐘 (需要更高方案)
每 30 分鐘 (需要更高方案)
分鐘
00
05
10
15
20
25
30
35
40
45
50
55
適用日
星期一
星期二
星期三
星期四
星期五
星期六
星期日
執行時間 (UTC)
適用日
星期一
星期二
星期三
星期四
星期五
星期六
星期日
執行時間 (UTC)
月份
每個月
選擇月份
一月
二月
三月
四月
五月
六月
七月
八月
九月
十月
十一月
十二月
日
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
執行時間 (UTC)
*
必填欄位
every
1
2
3
4
5
6
7
8
9
10
11
12
every
lastday
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
every
1
2
3
4
5
6
7
every
every4
every12
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
every15
every30
0
5
10
15
20
25
30
35
40
45
50
55
建立日期
-
上次執行
-
下次執行
-
CVE 描述
FreshRSS vulnerable to Cross-site Scripting by
'ing a vulnerable same-origin page in a feed entry</h3> FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting (XSS) issue that occurs in `f.php` when SVG favicons are downloaded from an attacker-controlled feed containing `<script>` tags inside of them that aren't sanitized, with the lack of CSP in `f.php` by embedding the malicious favicon in an iframe (that has `sandbox="allow-scripts allow-same-origin"` set as its attribute). An attacker needs to control one of the feeds that the victim is subscribed to, and also must have an account on the FreshRSS instance. Other than that, the iframe payload can be embedded as one of two options. The first payload requires user interaction (the user clicking on the malicious feed entry) with default user configuration, and the second payload fires instantly right after the user adds the feed or logs into the account while the feed entry is still visible. This is because of lazy image loading functionality, which the second payload bypasses. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 has a patch for the issue. </div> </div> <div class="card card-flush py-4"> <div class="card-header"> <div class="card-title"> <h2>CVE 資訊</h2> </div> </div> <div class="card-body pt-0"> <h2 class="tw-h3">相關弱點</h2> <div class="table-responsive"> <table class="table table-striped gy-7 gs-7"> <thead> <tr class="fw-semibold fs-6 text-gray-800 border-bottom border-gray-200"> <th><nobr>CWE-ID</nobr></th> <th>弱點名稱</th> <th>來源</th> </tr> </thead> <tbody> <tr> <td><nobr><a href="/zh-hant/cwe/cwe-79.html">CWE-79</a></nobr></td> <td><b>Improper Neutralization of Input During Web Page Generation</b><br>The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.</td> <td></td> </tr> </tbody> </table> </div> <div class="separator my-10"></div> <h3>指標</h3> <div class="table-responsive"> <table class="table table-striped gy-7 gs-7"> <thead> <tr class="fw-semibold fs-6 text-gray-800 border-bottom border-gray-200"> <th>指標</th> <th>評分</th> <th>嚴重程度</th> <th>CVSS 向量</th> <th>來源</th> </tr> </thead> <tbody> <tr> <td>V3.1</td> <td>6.7</td> <td>MEDIUM</td> <td> CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L <div class="m-0"> <div class="d-flex align-items-center collapsible toggle mb-0 collapsed" data-bs-toggle="collapse" data-bs-target="#metric-179441152691862" aria-expanded="false"> <div class="btn btn-sm btn-icon mw-20px btn-active-color-primary me-5"> <i class="ki-duotone ki-minus-square toggle-on text-primary fs-4"> <span class="path1"></span> <span class="path2"></span> </i> <i class="ki-duotone ki-plus-square toggle-off fs-4"> <span class="path1"></span> <span class="path2"></span> <span class="path3"></span> </i> </div> <span class="text-gray-700 cursor-pointer mb-0">更多資訊</span> </div> <div id="metric-179441152691862" class="fs-7 ms-1 collapse" style=""> <div class="mb-4"> <div class="d-flex align-items-center ps-10 mb-n1"> <div class="text-gray-600 fs-7"> <h4 class='bg-light border border-gray-300 rounded p-2'>Base: Exploitabilty Metrics</h4><p>The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.</p><div class='tw-h5' style='padding-left:10px'>Attack Vector</div><p style='padding-left:10px'>This metric reflects the context by which vulnerability exploitation is possible.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Network</p></div><div style='flex: 1;margin-left:5px;'><p>The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).</p></div></div><div class='tw-h5' style='padding-left:10px'>Attack Complexity</div><p style='padding-left:10px'>This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>High</p></div><div style='flex: 1;margin-left:5px;'><p> successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.</p></div></div><div class='tw-h5' style='padding-left:10px'>Privileges Required</div><p style='padding-left:10px'>This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.</p></div></div><div class='tw-h5' style='padding-left:10px'>User Interaction</div><p style='padding-left:10px'>This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Required</p></div><div style='flex: 1;margin-left:5px;'><p>Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Scope Metrics</h4><p>The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.</p><div class='tw-h5' style='padding-left:10px'>Scope</div><p style='padding-left:10px'>Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Unchanged</p></div><div style='flex: 1;margin-left:5px;'><p>An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Impact Metrics</h4><p>The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.</p><div class='tw-h5' style='padding-left:10px'>Confidentiality Impact</div><p style='padding-left:10px'>This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>High</p></div><div style='flex: 1;margin-left:5px;'><p>There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.</p></div></div><div class='tw-h5' style='padding-left:10px'>Integrity Impact</div><p style='padding-left:10px'>This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>High</p></div><div style='flex: 1;margin-left:5px;'><p>There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Availability Impact</div><p style='padding-left:10px'>This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Temporal Metrics</h4><p>The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.</p><h4 class='bg-light border border-gray-300 rounded p-2'>Environmental Metrics</h4><p>These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.</p> </div> </div> </div> </div> </div> </td> <td></td> </tr> <tr> <td>V3.1</td> <td>5.4</td> <td>MEDIUM</td> <td> CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N <div class="m-0"> <div class="d-flex align-items-center collapsible toggle mb-0 collapsed" data-bs-toggle="collapse" data-bs-target="#metric-179441152661834" aria-expanded="false"> <div class="btn btn-sm btn-icon mw-20px btn-active-color-primary me-5"> <i class="ki-duotone ki-minus-square toggle-on text-primary fs-4"> <span class="path1"></span> <span class="path2"></span> </i> <i class="ki-duotone ki-plus-square toggle-off fs-4"> <span class="path1"></span> <span class="path2"></span> <span class="path3"></span> </i> </div> <span class="text-gray-700 cursor-pointer mb-0">更多資訊</span> </div> <div id="metric-179441152661834" class="fs-7 ms-1 collapse" style=""> <div class="mb-4"> <div class="d-flex align-items-center ps-10 mb-n1"> <div class="text-gray-600 fs-7"> <h4 class='bg-light border border-gray-300 rounded p-2'>Base: Exploitabilty Metrics</h4><p>The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.</p><div class='tw-h5' style='padding-left:10px'>Attack Vector</div><p style='padding-left:10px'>This metric reflects the context by which vulnerability exploitation is possible.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Network</p></div><div style='flex: 1;margin-left:5px;'><p>The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).</p></div></div><div class='tw-h5' style='padding-left:10px'>Attack Complexity</div><p style='padding-left:10px'>This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Privileges Required</div><p style='padding-left:10px'>This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.</p></div></div><div class='tw-h5' style='padding-left:10px'>User Interaction</div><p style='padding-left:10px'>This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Required</p></div><div style='flex: 1;margin-left:5px;'><p>Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Scope Metrics</h4><p>The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.</p><div class='tw-h5' style='padding-left:10px'>Scope</div><p style='padding-left:10px'>Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Changed</p></div><div style='flex: 1;margin-left:5px;'><p>An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Impact Metrics</h4><p>The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.</p><div class='tw-h5' style='padding-left:10px'>Confidentiality Impact</div><p style='padding-left:10px'>This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Integrity Impact</div><p style='padding-left:10px'>This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Availability Impact</div><p style='padding-left:10px'>This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>None</p></div><div style='flex: 1;margin-left:5px;'><p>There is no impact to availability within the impacted component.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Temporal Metrics</h4><p>The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.</p><h4 class='bg-light border border-gray-300 rounded p-2'>Environmental Metrics</h4><p>These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.</p> </div> </div> </div> </div> </div> </td> <td>nvd@nist.gov</td> </tr> </tbody> </table> </div> <div class="separator my-10"></div> <h2>EPSS</h2> <div class="mb-4">EPSS 是一種預測漏洞被利用可能性的評分模型。</div> <h3>EPSS 評分</h3> <div>EPSS 模型產生介於 0 到 1（0% 到 100%）之間的概率分數。分數越高，漏洞被利用的概率越大。</div> <div id="chartEpss"></div> <div style="text-align:center;"> <input type="button" class="" value="查看數值表格" onclick="$(document).ready(function() {$('#chartEpssBoard').slideToggle();});"> </div> <div id="chartEpssBoard" style="display: none;align-content: center;"> <br><table border="1" cellspacing="0" cellpadding="5" class="table table-bordered"><thead><tr><th>日期</th><th>EPSS V0</th><th>EPSS V1</th><th>EPSS V2<br>(> 2022-02-04)</th><th>EPSS V3<br>(> 2025-03-07)</th><th>EPSS V4<br>(> 2025-03-17)</th></tr></thead><tbody><tr><td>2025-06-05</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-06-11</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-16</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-18</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-19</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-20</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-23</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-07-06</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-08-11</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-09-08</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-10-04</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.07%</td></tr><tr><td>2025-10-31</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.03%</td></tr><tr><td>2025-11-01</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.03%</td></tr><tr><td>2025-11-12</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-11-18</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.08%</td></tr><tr><td>2025-11-21</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-12-29</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2026-01-05</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2026-01-07</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2026-01-08</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2026-02-22</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.09%</td></tr><tr><td>2026-03-01</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.1%</td></tr><tr><td>2026-03-22</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.11%</td></tr><tr><td>2026-04-05</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.3%</td></tr><tr><td>2026-05-17</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.3%</td></tr><tr><td>2026-06-14</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.23%</td></tr></tbody></table> </div> <h3>EPSS 百分位數</h3> <div>百分位數用於根據 EPSS 分數對 CVE 進行排名。例如，EPSS 評分在第 95 百分位的 CVE 比 95% 的其他 CVE 更有可能被利用。因此，百分位數用於比較某 CVE 的 EPSS 分數與其他 CVE 的相對位置。</div> <div id="chartPercentile"></div> <div class="text-center"> <a href="https://www.first.org/epss/" target="_parent">EPSS First.org<i class="ki-duotone ki-exit-right-corner" style="font-size: 10px;vertical-align:8px"><span class="path1"></span><span class="path2"></span></i></a> </div> <div style="text-align:center;"> <input type="button" class="" value="查看數值表格" onclick="$(document).ready(function() {$('#chartPercentileBoard').slideToggle();});"> </div> <div id="chartPercentileBoard" style="display: none;align-content: center;"> <br><table border="1" cellspacing="0" cellpadding="5" class="table table-bordered"><thead><tr><th>日期</th><th>百分位</th></tr></thead><tbody><tr><td>2025-06-05</td><td>14%</td></tr><tr><td>2025-06-11</td><td>12%</td></tr><tr><td>2025-06-16</td><td>11%</td></tr><tr><td>2025-06-18</td><td>12%</td></tr><tr><td>2025-06-19</td><td>11%</td></tr><tr><td>2025-06-20</td><td>12%</td></tr><tr><td>2025-06-23</td><td>11%</td></tr><tr><td>2025-07-06</td><td>14%</td></tr><tr><td>2025-08-11</td><td>16%</td></tr><tr><td>2025-09-08</td><td>17%</td></tr><tr><td>2025-10-04</td><td>22%</td></tr><tr><td>2025-10-31</td><td>8%</td></tr><tr><td>2025-11-01</td><td>7%</td></tr><tr><td>2025-11-12</td><td>1%</td></tr><tr><td>2025-11-18</td><td>2%</td></tr><tr><td>2025-11-21</td><td>1%</td></tr><tr><td>2025-12-29</td><td>14%</td></tr><tr><td>2026-01-05</td><td>13%</td></tr><tr><td>2026-01-07</td><td>14%</td></tr><tr><td>2026-01-08</td><td>17%</td></tr><tr><td>2026-02-22</td><td>25%</td></tr><tr><td>2026-03-01</td><td>27%</td></tr><tr><td>2026-03-22</td><td>29%</td></tr><tr><td>2026-04-05</td><td>53%</td></tr><tr><td>2026-05-17</td><td>54%</td></tr><tr><td>2026-06-14</td><td>46%</td></tr></tbody></table> </div> <script> var optionsEpss = { chart: { fontFamily: 'inherit', type: 'area', height: 250 }, series: [ {name: 'EPSS V0',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V1',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V2',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V3',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V4',data: [0.05,0.04,0.04,0.04,0.04,0.04,0.04,0.05,0.05,0.05,0.07,0.03,0.03,0.04,0.08,0.04,0.04,0.04,0.04,0.05,0.09,0.1,0.11,0.3,0.3,0.23]} ], xaxis: { categories: [1749089468000,1749607867000,1750039873000,1750212665000,1750299068000,1750385484000,1750644682000,1751767884000,1754878270000,1757297465000,1759543862000,1761880269000,1761966672000,1762917067000,1763435462000,1763694665000,1766977864000,1767582682000,1767755476000,1767841874000,1771723241000,1772328050000,1774142449000,1775348450000,1778977249000,1781396456000], type: 'datetime' }, stroke: { curve: 'straight', }, tooltip: { x: { format: 'yyyy-dd-MM' }, y: { formatter: function(value) { if (value!=null) return `${value}%`; } } }, dataLabels: { enabled: true, formatter: function (val) { if (val!=null) return val + '%'; } } }; </script> <script> var optionsPercentile = { chart: { fontFamily: 'inherit', type: 'area', height: 250 }, series: [{ name: 'Percentile', data: [14,12,11,12,11,12,11,14,16,17,22,8,7,10,20,10,14,13,14,17,25,27,29,53,54,46] }], xaxis: { categories: [1749089468000,1749607867000,1750039873000,1750212665000,1750299068000,1750385484000,1750644682000,1751767884000,1754878270000,1757297465000,1759543862000,1761880269000,1761966672000,1762917067000,1763435462000,1763694665000,1766977864000,1767582682000,1767755476000,1767841874000,1771723241000,1772328050000,1774142449000,1775348450000,1778977249000,1781396456000], type: 'datetime' }, stroke: { curve: 'straight', }, tooltip: { x: { format: 'yyyy-dd-MM' }, y: { formatter: function(value) { if (value!=null) return `${value}%`; } } }, dataLabels: { enabled: true, formatter: function (val) { if (val!=null) return val + '%'; } } }; </script> <div class="separator my-10"></div> <h2 class="tw-h3">相關產品</h2> <h3 class='tw-h4'>設定 0</h3><p>Freshrss>>Freshrss >> Version 至（不含） 1.26.2</p> <div class="separator my-10"></div> <h2 class='tw-h3'>參考資料</h2><div style='margin-bottom: 10px;'><a href='https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr' target='_blank'>https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr <i class="ki-duotone ki-exit-right-corner" style="font-size: 10px;vertical-align:8px"><span class="path1"></span><span class="path2"></span></i></a><br><span style='margin-left:20px;'>Tags : x_refsource_CONFIRM</span></div><div style='margin-bottom: 10px;'><a href='https://github.com/FreshRSS/FreshRSS/commit/426e3054c237c2b98667ebeacbbdb5caa88e7b1f' target='_blank'>https://github.com/FreshRSS/FreshRSS/commit/426e3054c237c2b98667ebeacbbdb5caa88e7b1f <i class="ki-duotone ki-exit-right-corner" style="font-size: 10px;vertical-align:8px"><span class="path1"></span><span class="path2"></span></i></a><br><span style='margin-left:20px;'>Tags : x_refsource_MISC</span></div><div class="separator my-10"></div> </div> </div> </div> </div> </div> </div> <!--end::Container--> <!--begin::Footer--> <div class="footer py-4 d-flex flex-lg-column" id="kt_footer"> <div class="container-xxl d-flex flex-column flex-md-row align-items-center justify-content-between"> <div class="text-gray-900 order-2 order-md-1"> <span class="text-muted fw-semibold me-1">2026©</span> <a href="https://www.tesweb.com" target="_blank" class="text-gray-800 text-hover-primary">tesweb SA</a>, <a href="https://www.bexxo.ch" target="_blank" class="text-gray-800 text-hover-primary">bexxo Cyber Security</a> </div> <ul class="menu menu-gray-600 menu-hover-primary fw-semibold order-1"> <li class="menu-item"> <a href="/zh-hant/official.html" class="menu-link px-2">資料來源</a> </li> <li class="menu-item"> <a href="/zh-hant/gdpr.html" class="menu-link px-2">GDPR</a> </li> <li class="menu-item"> <a href="#" id="gdpr-manage-cookies" class="menu-link px-2">管理 Cookie</a> </li> <li class="menu-item"> <a href="/zh-hant/contact.html" class="menu-link px-2">聯絡</a> </li> <li class="menu-item"> <a href="/zh-hant/plan-price.html" class="menu-link px-2">購買</a> </li> <li class="menu-item"> <a href="https://www.linkedin.com/company/cve-find/" class="menu-link px-2" target="_blank"><img src="/media/social/linkedin.svg" width="40" height="40" alt="LinkedIn Account"/></a> </li> <li class="menu-item"> <a href="https://www.facebook.com/people/CVE-Find-Alert/61561116452093/" class="menu-link px-2" target="_blank"><img src="/media/social/facebook.svg" width="40" height="40" alt="Facebook Account"/></a> </li> <li class="menu-item"> <a href="https://x.com/cvefindcom" class="menu-link px-2" target="_blank"><img src="/media/social/twitter.svg" width="40" height="40" alt="Twitter Account"/></a> </li> </ul> </div> </div> <div class="footer py-4"> <div class="container-xxl align-items-center justify-content-between"> cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 <a href="https://cve.mitre.org/" target="_blank">MITRE Corporation</a> 和 <a href="https://nvd.nist.gov/" target="_blank">國家漏洞資料庫（NVD）</a>提供。已知被利用漏洞（KEV）目錄來自 <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">網路安全暨基礎設施安全局（CISA）</a>，而 EPSS 評分來自 <a href="https://www.first.org/epss/" target="_blank">FIRST.org</a>。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 <a href="https://mitre.org/" target="_blank">MITRE Corporation</a> 維護，硬軟體配置（CPE）資訊由 <a href="https://nvd.nist.gov/products/cpe" target="_blank">NVD</a> 提供。 </div> </div> </div> </div> </div> <!--begin::Javascript--> <script>var hostUrl = "assets/";</script> <script src="/plugins/global/plugins.bundle.min.1743008562.js"></script> <script src="/js/scripts.bundle.1718974735.js"></script> <script src="/js/app/custom.min.1788264851.js"></script> <script src="/js/app/base.zh-hant.min.1793721675.js" defer></script> <script src="/plugins/custom/datatables/datatables.bundle.1718974031.js"></script> <script src="/js/aceeditor/ace.1715679271.js"></script> <script src="/js/app/bloc/cve/epss.min.1738322185.js"></script> <script src="/js/app/bloc/cve/exploitdb.min.1738322201.js"></script> <script src="/js/app/account/manageAlertNeedAccount.min.1782998772.js" defer></script> <div class="ea-slot d-lg-none" data-ea-anchor="mobile" data-ea-pub="cvefindcom" data-ea-type="text" data-ea-style="fixedfooter" data-ea-kw="security|cybersecurity|vulnerability|cve"></div> <style> /* Encart EthicalAds centré dans son emplacement */ .ea-slot [data-ea-publisher]{margin-left:auto;margin-right:auto;} /* Format horizontal : remplit la largeur de la colonne (variable officielle EthicalAds) */ .ea-slot [data-ea-publisher].horizontal{--ea-image-placement-width-horizontal:100%;} </style> <script async src="https://media.ethicalads.io/media/client/ethicalads.min.js"></script> <script src="/js/app/ads/ethicalads.min.1792667231.js" defer></script> </body> </html> <script> var cookieTimezoneBrowser = function () { let timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone; var offset = -new Date().getTimezoneOffset(); var prefix = offset >= 0 ? '+' : '-'; var timezoneOffset = prefix + Math.floor(Math.abs(offset) / 60).toString().padStart(2, '0') + ':' + (Math.abs(offset) % 60).toString().padStart(2, '0'); document.cookie = "tw-browser=" + timeZone+"|"+ timezoneOffset+ "; path=/"; } cookieTimezoneBrowser(); </script>
