Fallos del tipo CWE-89

11.906 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-9469MEDIUMitsourcecode Apartment Management System add_fund.php sql injectionEPSS 0.5%CVE-2025-9471MEDIUMitsourcecode Apartment Management System add_maintenance_cost.php sql injectionEPSS 0.5%CVE-2025-10482MEDIUMSourceCodester Online Student File Management System index.php sql injectionEPSS 0.5%CVE-2022-4739HIGHSourceCodester School Dormitory Management System Admin Login sql injectionEPSS 0.5%CVE-2025-9470MEDIUMitsourcecode Apartment Management System add_m_committee.php sql injectionEPSS 0.5%CVE-2025-62423MEDIUMClipBucket V5 Blind SQL injection in the Admin PanelEPSS 0.5%CVE-2025-63453CRITICALCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.EPSS 0.5%CVE-2024-3816CRITICALSQLi in S@M CMSEPSS 0.5%CVE-2025-25513CRITICALSeacms <=13.3 is vulnerable to SQL Injection in admin_members.php.EPSS 0.5%CVE-2025-10667MEDIUMitsourcecode Online Discussion Forum compose_msg.php sql injectionEPSS 0.5%CVE-2025-63451CRITICALCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.EPSS 0.5%CVE-2026-46624CRITICALTwenty: SQL Injection via the timeZone fieldEPSS 0.5%CVE-2025-32677HIGHWordPress WP Social Stream Designer plugin <= 1.3 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-3592CRITICALQuiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2025-9767MEDIUMitsourcecode Sports Management System sporttype.php sql injectionEPSS 0.5%CVE-2025-9468MEDIUMitsourcecode Apartment Management System add_bill.php sql injectionEPSS 0.5%CVE-2025-10448MEDIUMCampcodes Online Job Finder System index.php sql injectionEPSS 0.5%CVE-2025-61028HIGHAn issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.5%CVE-2025-25519CRITICALSeacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.EPSS 0.5%CVE-2026-12045CRITICALpgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionEPSS 0.5%