Fallos del tipo CWE-89

11.910 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-40735HIGHA vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected devices are vulnerable to SQL injection. This could allEPSS 0.5%CVE-2026-28805HIGHOpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` ParameterEPSS 0.5%CVE-2019-25543HIGHNetartmedia Real Estate Portal 5.0 SQL Injection via index.phpEPSS 0.5%CVE-2025-27617MEDIUMPimcore Vulnerable to SQL Injection in getRelationFilterConditionEPSS 0.5%CVE-2019-25542HIGHNetartmedia Real Estate Portal 5.0 SQL Injection via index.phpEPSS 0.5%CVE-2025-26186HIGHSQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.phpEPSS 0.5%CVE-2025-44034HIGHSQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/EPSS 0.5%CVE-2025-4060MEDIUMPHPGurukul Notice Board System category.php sql injectionEPSS 0.5%CVE-2024-11714MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()EPSS 0.5%CVE-2024-12067MEDIUMWP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2025-5119MEDIUMEmlog Pro api_controller.php sql injectionEPSS 0.5%CVE-2024-2386HIGHWordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2025-30971CRITICALWordPress XV Random Quotes plugin <= 2.0.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-34099CRITICALGuardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.phpEPSS 0.5%CVE-2024-53807HIGHWordPress WP Mailster plugin <= 1.8.16.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-47325HIGHWordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-56162MEDIUMYOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds fuEPSS 0.5%CVE-2024-28560MEDIUMSQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of tEPSS 0.5%CVE-2024-13475HIGHSmall Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2024-47223CRITICALA vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unEPSS 0.5%