更新: 103 个文件 - 2026-03-18 19:24:37

07-framework-security/cms/ghost/INDEX.md

@@ -5,14 +5,14 @@
 - 系统 ID: `ghost`
 - 分类: `cms`
 - 覆盖策略: `history-full`
-- 总案例数: `0`
+- 总案例数: `23`
 - 近 30 天新增/更新: `0`
 - 重点 Markdown 案例数: `0`
 - 已实证(真实版本): `0`
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
-- 待人工/缺浏览器证据: `0`
-- 最近渲染时间: `2026-03-18T21:18:14+00:00`
+- 待人工/缺浏览器证据: `23`
+- 最近渲染时间: `2026-03-19T02:23:04+00:00`
 
 ## 目标约束
 
@@ -26,9 +26,35 @@
 
 - `official` [Ghost GitHub Advisories](https://github.com/TryGhost/Ghost/security/advisories) (mode=core)
 - `official` [NVD Ghost](https://nvd.nist.gov/vuln/search) (keyword=Ghost CMS; mode=core)
+- `ecosystem-authority` [OSV Ghost](https://osv.dev/) (mode=core)
 
 ## 案例列表
 
 | 标题 | 严重度 | 案例状态 | 实证状态 | 实证方式 | 来源置信度 | 更新时间 | 案例页 |
 |------|--------|----------|----------|----------|------------|----------|--------|
-| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | `n/a` | `n/a` | - |
+| Issues 
+           63 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Incomplete CSRF protections around OTC use | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| SQL Injection in Members Activity Feed | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Sign in | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| SQL injection in Content API | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| TryGhost | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| 2 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| SSRF via External Media Inliner | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Pull requests 
+           307 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Insights | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Improper authentication allows access to member information and actions | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Sign up | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Staff 2FA bypass | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| XSS via malicious Portal preview links | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Staff Token permission bypass | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Ghost | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Notifications | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Skip to content | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Security 
+           18 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Actions | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Remote Code Execution via Malicious Themes | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| SSRF via oEmbed Bookmark | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
+| Policy | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |