Fallos del tipo CWE-89

11.906 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-2871MEDIUMMedia Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.5%CVE-2024-31241HIGHWordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerabilityEPSS 0.5%CVE-2024-57768CRITICALJFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.EPSS 0.5%CVE-2026-26695CRITICALcode-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php.EPSS 0.5%CVE-2023-28849CRITICALGLPI vulnerable to SQL injection and Stored XSS via inventory agent requestEPSS 0.5%CVE-2025-3856MEDIUMxxyopen Novel-Plus searchByPage sql injectionEPSS 0.5%CVE-2025-22691HIGHWordPress WP Travel plugin <= 10.1.3 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-26696CRITICALcode-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.EPSS 0.5%CVE-2024-13152CRITICALSQLi in BSS Software's Mobuy Online Machinery Monitoring PanelEPSS 0.5%CVE-2025-1389HIGHLearning Digital Orca HCM - SQL InjectionEPSS 0.5%CVE-2024-5543HIGHSlideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2024-32551HIGHWordPress SP Project & Document Manage plugin <= 4.71 - Auth. SQL Injection vulnerabilityEPSS 0.5%CVE-2024-9201CRITICALSQL injection vulnerability in SEUR pluginEPSS 0.5%CVE-2025-1820MEDIUMzj1983 zz ZworkflowAction.java getOaWid sql injectionEPSS 0.5%CVE-2024-10171MEDIUMcode-projects Blood Bank System massage.php sql injectionEPSS 0.5%CVE-2025-1832MEDIUMzj1983 zz ZroleAction.java getUserList sql injectionEPSS 0.5%CVE-2025-65354CRITICALImproper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_namEPSS 0.5%CVE-2024-34989CRITICALIn the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFPEPSS 0.5%CVE-2024-24375HIGHSQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.EPSS 0.5%CVE-2025-40711CRITICALSQL injection vulnerability in Quiter GatewayEPSS 0.5%