Fallos del tipo CWE-89

11.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-2777MEDIUMCampcodes/PHPGurukul Online Marriage Registration System application-bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-57515CRITICALA SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL cEPSS 0.5%CVE-2024-10734MEDIUMProject Worlds Life Insurance Management System editPayment.php sql injectionEPSS 0.5%CVE-2024-10610MEDIUMESAFENET CDG ProtocolService.java delProtocol sql injectionEPSS 0.5%CVE-2025-0409MEDIUMliujianview gymxmjpa MembertypeController.java MembertypeDaoImpl sql injectionEPSS 0.5%CVE-2025-0406MEDIUMliujianview gymxmjpa SubjectController.java SubjectDaoImpl sql injectionEPSS 0.5%CVE-2024-10735MEDIUMProject Worlds Life Insurance Management System editNominee.php sql injectionEPSS 0.5%CVE-2024-6418MEDIUMSourceCodester Medicine Tracker System sql injectionEPSS 0.5%CVE-2024-7112HIGHPinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2024-10738MEDIUMitsourcecode Farm Management System manage-breed.php sql injectionEPSS 0.5%CVE-2025-4808MEDIUMPHPGurukul Park Ticketing Management System add-normal-ticket.php sql injectionEPSS 0.5%CVE-2023-22378HIGHAuthenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2EPSS 0.5%CVE-2024-10427MEDIUMCodezips Pet Shop Management System deleteanimal.php sql injectionEPSS 0.5%CVE-2024-10423MEDIUMProject Worlds Student Project Allocation System Project Selection Page project_selection.php sql injectionEPSS 0.5%CVE-2025-28873HIGHWordPress Shuffle plugin <= 0.5 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-8557MEDIUMSourceCodester Food Ordering Management System cancel-order.php sql injectionEPSS 0.5%CVE-2025-0410MEDIUMliujianview gymxmjpa MenberConntroller.java MenberDaoInpl sql injectionEPSS 0.5%CVE-2025-3310MEDIUMcode-projects Blood Bank Management System delete.php sql injectionEPSS 0.5%CVE-2024-11058MEDIUMCodeAstro Real Estate Management System About Us Page aboutedit.php sql injectionEPSS 0.5%CVE-2025-3339MEDIUMcodeprojects Online Restaurant Management System user_update.php sql injectionEPSS 0.5%