Fallos del tipo CWE-89

11.870 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-8166MEDIUMcode-projects Church Donation System HTTP POST Request index.php sql injectionEPSS 0.5%CVE-2025-8431MEDIUMPHPGurukul Boat Booking System add-boat.php sql injectionEPSS 0.5%CVE-2024-12895MEDIUMTreasureHuntGame TreasureHunt checkflag.php console_log sql injectionEPSS 0.5%CVE-2025-1172MEDIUM1000 Projects Bookstore Management System addtocart.php sql injectionEPSS 0.5%CVE-2024-12894MEDIUMTreasureHuntGame TreasureHunt acesso.php sql injectionEPSS 0.5%CVE-2025-7172MEDIUMcode-projects Crime Reporting System headlogin.php sql injectionEPSS 0.5%CVE-2024-45608MEDIUMGLPI has an Authenticated SQL InjectionEPSS 0.5%CVE-2025-55167CRITICALWeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`EPSS 0.5%CVE-2025-22957CRITICALA SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. ThEPSS 0.5%CVE-2024-52474CRITICALWordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-36673CRITICALSourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadEPSS 0.5%CVE-2025-13757HIGHSQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.EPSS 0.5%CVE-2024-34533HIGHA SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows aEPSS 0.5%CVE-2025-3243MEDIUMcode-projects Patient Record Management System dental_form.php sql injectionEPSS 0.5%CVE-2024-9925CRITICALSQL injection in QPLANT by TAI Smart FactoryEPSS 0.5%CVE-2024-41679MEDIUMAuthenticated SQL injection in ticket formEPSS 0.5%CVE-2024-12032MEDIUMTourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2023-4531CRITICALSQLi in Mestavs E-commerce SoftwareEPSS 0.5%CVE-2023-6677CRITICALSQLi in Oduyo Online Collection SoftwareEPSS 0.5%CVE-2024-31233HIGHWordPress Rehub theme <= 19.6.1 - Auth. SQL Injection vulnerabilityEPSS 0.5%