Fallos del tipo CWE-89

11.909 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-13369MEDIUMTour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id ParameterEPSS 0.5%CVE-2025-25226CRITICAL[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database packageEPSS 0.5%CVE-2025-4734MEDIUMCampcodes Sales and Inventory System ci_update.php sql injectionEPSS 0.5%CVE-2024-43774HIGHHuachu Easytest Online Learning Test Platform - SQL InjectionEPSS 0.5%CVE-2025-5078MEDIUMPHPGurukul/Campcodes Online Shopping Portal subcategory.php sql injectionEPSS 0.5%CVE-2025-54119CRITICALADOdb's sqlite3 driver allows SQL injectionEPSS 0.5%CVE-2025-7177MEDIUMPHPGurukul Car Washing Management System editcar-washpoint.php sql injectionEPSS 0.5%CVE-2026-33485HIGHAVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name ParameterEPSS 0.5%CVE-2023-5293MEDIUMECshop leancloud.php sql injectionEPSS 0.5%CVE-2018-25185HIGHWecodex Restaurant CMS 1.0 SQL Injection via LoginEPSS 0.5%CVE-2023-39423HIGHImproper Neutralization of Special Elements used in an SQL Command in RDPData.dllEPSS 0.5%CVE-2025-6173MEDIUMWebkul QloApps ajax_products_list.php sql injectionEPSS 0.5%CVE-2024-50824LOWA SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name parametEPSS 0.5%CVE-2024-37225HIGHWordPress Zoho Marketing Automation plugin <= 1.2.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-1593MEDIUMitsourcecode Society Management System edit_expenses_query.php sql injectionEPSS 0.5%CVE-2026-2058MEDIUMmathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injectionEPSS 0.5%CVE-2025-10586CRITICALCommunity Events <= 1.5.1 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2025-26943CRITICALWordPress Easy Quotes plugin <= 1.2.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-27179HIGHMajorDoMo Unauthenticated SQL Injection in Commands ModuleEPSS 0.5%CVE-2025-56421HIGHSQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.EPSS 0.5%