Fallos del tipo CWE-89

11.906 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-7935MEDIUMitsourcecode Project Expense Monitoring System print.php sql injectionEPSS 0.5%CVE-2024-5098MEDIUMSourceCodester Simple Inventory System login.php sql injectionEPSS 0.5%CVE-2025-40711CRITICALSQL injection vulnerability in Quiter GatewayEPSS 0.5%CVE-2024-5325HIGHForm Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_dataEPSS 0.5%CVE-2025-24905CRITICALSQL Injection endpoint 'get_codigobarras_cobranca.php' parameter 'codigo' in WeGIAEPSS 0.5%CVE-2024-47328HIGHWordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 3.1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-7934MEDIUMitsourcecode Project Expense Monitoring System execute.php sql injectionEPSS 0.5%CVE-2025-32968HIGHorg.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query APIEPSS 0.5%CVE-2024-11127MEDIUMcode-projects Job Recruitment admin.php sql injectionEPSS 0.5%CVE-2024-3816CRITICALSQLi in S@M CMSEPSS 0.5%CVE-2025-25513CRITICALSeacms <=13.3 is vulnerable to SQL Injection in admin_members.php.EPSS 0.5%CVE-2024-3592CRITICALQuiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2024-8436CRITICALWP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2025-63453CRITICALCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.EPSS 0.5%CVE-2025-32676HIGHWordPress Verowa Connect plugin <= 3.0.5 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-62423MEDIUMClipBucket V5 Blind SQL injection in the Admin PanelEPSS 0.5%CVE-2024-33149HIGHJ2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function.EPSS 0.5%CVE-2025-9469MEDIUMitsourcecode Apartment Management System add_fund.php sql injectionEPSS 0.5%CVE-2023-44755CRITICALSacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /sacco/ajax.php.EPSS 0.5%CVE-2025-9470MEDIUMitsourcecode Apartment Management System add_m_committee.php sql injectionEPSS 0.5%