Fallos del tipo CWE-89

11.866 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-10740MEDIUMcode-projects E-Health Care System consulting_detail.php sql injectionEPSS 0.5%CVE-2023-2412MEDIUMSourceCodester AC Repair and Services System manage_user.php sql injectionEPSS 0.5%CVE-2024-0274MEDIUMKashipara Food Management System billAjax.php sql injectionEPSS 0.5%CVE-2024-10069MEDIUMESAFENET CDG MailDecryptApplicationService.java actionPassMainApplication sql injectionEPSS 0.5%CVE-2025-65133CRITICALA SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remEPSS 0.5%CVE-2025-2378MEDIUMPHPGurukul Medical Card Generation System download-medical-cards.php sql injectionEPSS 0.5%CVE-2025-2662MEDIUMProject Worlds Online Time Table Generator studentdashboard.php sql injectionEPSS 0.5%CVE-2023-4447MEDIUMOpenRapid RapidCMS article-chat.php sql injectionEPSS 0.5%CVE-2024-0272MEDIUMKashipara Food Management System addmaterialsubmit.php sql injectionEPSS 0.5%CVE-2024-10071MEDIUMESAFENET CDG EncryptPolicyService.java actionUpdateEncryptPolicyEdit sql injectionEPSS 0.5%CVE-2024-0281MEDIUMKashipara Food Management System loginCheck.php sql injectionEPSS 0.5%CVE-2024-0276MEDIUMKashipara Food Management System rawstock_used_damaged_smt.php sql injectionEPSS 0.5%CVE-2024-6003MEDIUMGuangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injectionEPSS 0.5%CVE-2024-10070MEDIUMESAFENET CDG PolicyPushControlAction.java actionPolicyPush sql injectionEPSS 0.5%CVE-2024-9574CRITICALSQL Injection vulnerability in SOPlanningEPSS 0.5%CVE-2023-39292CRITICALA SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious acEPSS 0.5%CVE-2024-3131MEDIUMSourceCodester Computer Laboratory Management System sql injectionEPSS 0.5%CVE-2025-1172MEDIUM1000 Projects Bookstore Management System addtocart.php sql injectionEPSS 0.5%CVE-2025-8375MEDIUMcode-projects Vehicle Management addvehicle.php sql injectionEPSS 0.5%CVE-2025-8431MEDIUMPHPGurukul Boat Booking System add-boat.php sql injectionEPSS 0.5%