Fallos del tipo CWE-89

11.877 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-45210MEDIUMJeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.EPSS 0.5%CVE-2025-0846MEDIUM1000 Projects Employee Task Management System AdminLogin.php sql injectionEPSS 0.5%CVE-2024-12030MEDIUMMDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2023-1506MEDIUMSourceCodester E-Commerce System login.php sql injectionEPSS 0.5%CVE-2023-49581MEDIUMSQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP PlatformEPSS 0.5%CVE-2024-8757HIGHBoost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL InjectionEPSS 0.5%CVE-2024-5653MEDIUMChanjet Smooth T+system keyEdit.aspx sql injectionEPSS 0.5%CVE-2025-4781MEDIUMPHPGurukul Park Ticketing Management System forgot-password.php sql injectionEPSS 0.5%CVE-2025-57870CRITICALBUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.EPSS 0.5%CVE-2022-45208MEDIUMJeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.EPSS 0.5%CVE-2024-58309HIGHxbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.phpEPSS 0.5%CVE-2024-7780HIGHContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL InjectionEPSS 0.5%CVE-2025-1576MEDIUMcode-projects Real Estate Property Management System ajax_state.php sql injectionEPSS 0.5%CVE-2026-49048HIGHJoomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1EPSS 0.5%CVE-2024-10244CRITICALSQLi in ISDO Software's Web SoftwareEPSS 0.5%CVE-2025-1167MEDIUMMayuri K Employee Management System Update_User.php sql injectionEPSS 0.5%CVE-2025-8935MEDIUM1000 Projects Sales Management System custcmp.php sql injectionEPSS 0.5%CVE-2025-10596MEDIUMSourceCodester Online Exam Form Submission index.php sql injectionEPSS 0.5%CVE-2025-32565CRITICALWordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerabilityEPSS 0.5%CVE-2025-8932MEDIUM1000 Projects Sales Management System sales.php sql injectionEPSS 0.5%