Fallos del tipo CWE-89

11.879 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-31234HIGHWordPress REHub Framework plugin < 19.6.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-5268MEDIUMDedeBIZ makehtml_taglist_action.php sql injectionEPSS 0.5%CVE-2024-6014MEDIUMitsourcecode Document Management System edithis.php sql injectionEPSS 0.5%CVE-2023-23574HIGHAuthenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2EPSS 0.5%CVE-2024-5364MEDIUMSourceCodester Best House Rental Management System manage_tenant.php sql injectionEPSS 0.5%CVE-2024-4466CRITICALSQL injection vulnerability in GescenEPSS 0.5%CVE-2023-2567HIGHAuthenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0EPSS 0.5%CVE-2023-34476—Extension - mooj.org - SQLi in Proforms Basic component for Joomla <= 1.6.0EPSS 0.5%CVE-2024-5366MEDIUMSourceCodester Best House Rental Management System edit-cate.php sql injectionEPSS 0.5%CVE-2023-43983CRITICALPresto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php.EPSS 0.5%CVE-2023-23757—Extension - bestaddon.com - SQLi in BA Gallery component for Joomla <= 1.2.0EPSS 0.5%CVE-2024-43286HIGHWordPress Squirrly SEO plugin <= 12.3.19 - SQL Injection vulnerabilityEPSS 0.5%CVE-2022-2665MEDIUMSourceCodester Simple E-Learning System classroom.php sql injectionEPSS 0.5%CVE-2025-9021MEDIUMSourceCodester Online Bank Management System transfer.php sql injectionEPSS 0.5%CVE-2023-41884HIGHZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.phpEPSS 0.5%CVE-2025-3676MEDIUMxxyopen Novel-Plus books sql injectionEPSS 0.5%CVE-2024-10732MEDIUMTongda OA 2017 index.php sql injectionEPSS 0.5%CVE-2024-10730MEDIUMTongda OA web_show.php sql injectionEPSS 0.5%CVE-2024-44838CRITICALRapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.EPSS 0.5%CVE-2024-33268CRITICALSQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addEPSS 0.5%