Fallos del tipo CWE-89

11.909 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-39423HIGHImproper Neutralization of Special Elements used in an SQL Command in RDPData.dllEPSS 0.5%CVE-2025-4870MEDIUMitsourcecode Restaurant Management System menu_save.php sql injectionEPSS 0.5%CVE-2025-25206HIGHIncorrect input validation could allow an authenticated user to read sensitive informationEPSS 0.5%CVE-2025-22527HIGHWordPress Mailing Group Listserv Plugin <= 2.0.9 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-1464MEDIUMBaiyi Cloud Asset Management System admin.house.collect.php sql injectionEPSS 0.5%CVE-2025-26520HIGHCacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue EPSS 0.5%CVE-2026-0578MEDIUMcode-projects Online Product Reservation System delete.php sql injectionEPSS 0.5%CVE-2026-2690MEDIUMitsourcecode Event Management System Admin Login ajax.php sql injectionEPSS 0.5%CVE-2025-1580MEDIUMPHPGurukul Nipah Virus Testing Management System search-report-result.php sql injectionEPSS 0.5%CVE-2025-22351HIGHWordPress Contact Form 7 Database – CFDB7 plugin <= 1.0.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-34260CRITICALSQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)EPSS 0.5%CVE-2022-3013MEDIUMSourceCodester Simple Task Managing System loginVaLidation.php sql injectionEPSS 0.5%CVE-2025-22349HIGHWordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-6484MEDIUMcode-projects Online Shopping Store action.php sql injectionEPSS 0.5%CVE-2024-57162HIGHCampcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php.EPSS 0.5%CVE-2024-7078CRITICALUnauthenticate SQLi in Semtek Informatics Software's Semtek SemposEPSS 0.5%CVE-2024-8344MEDIUMCampcodes Supplier Management System edit_area.php sql injectionEPSS 0.5%CVE-2023-4441MEDIUMSourceCodester Free Hospital Management System for Small Practices appointment.php sql injectionEPSS 0.5%CVE-2024-11837HIGHN1QL InjectionEPSS 0.5%CVE-2024-7076CRITICALSQLi in Semtek Informatics Software's Semtek SemposEPSS 0.5%