Fallos del tipo CWE-89

11.873 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-5329HIGHUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] ParameterEPSS 0.5%CVE-2024-7372MEDIUMSourceCodester Simple Realtime Quiz System quiz_board.php sql injectionEPSS 0.5%CVE-2024-6338HIGHFV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude ParameterEPSS 0.5%CVE-2024-0733MEDIUMSmsot HTTP POST Request api.php sql injectionEPSS 0.5%CVE-2025-0391MEDIUMGuangzhou Huayi Intelligent Technology Jeewms CgFormBuildController. java saveOrUpdate sql injectionEPSS 0.5%CVE-2026-33767HIGHAVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into QueryEPSS 0.5%CVE-2024-5105MEDIUMCampcodes Complete Web-Based School Management System student_payment_details.php sql injectionEPSS 0.5%CVE-2023-34976CRITICALVideo StationEPSS 0.5%CVE-2024-50713CRITICALSmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php.EPSS 0.5%CVE-2024-7827HIGHShopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number ParameterEPSS 0.5%CVE-2024-7371MEDIUMSourceCodester Simple Realtime Quiz System quiz_view.php sql injectionEPSS 0.5%CVE-2024-8924HIGHUnauthenticated Blind SQL Injection in Core PlatformEPSS 0.5%CVE-2024-7373MEDIUMSourceCodester Simple Realtime Quiz System ajax.php sql injectionEPSS 0.5%CVE-2024-5104MEDIUMCampcodes Complete Web-Based School Management System student_grade_wise.php sql injectionEPSS 0.5%CVE-2024-3561HIGHCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom FieldEPSS 0.5%CVE-2024-10378MEDIUMESAFENET CDG CDGRenewApplicationService.java actionViewCDGRenewFile sql injectionEPSS 0.5%CVE-2025-31553CRITICALWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-7754MEDIUMSourceCodester Clinics Patient Management System check_medicine_name.php sql injectionEPSS 0.5%CVE-2024-13070MEDIUMCodeAstro Online Food Ordering System Update User Page update_users.php sql injectionEPSS 0.5%CVE-2025-0344MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%