Fallos del tipo CWE-89

11.878 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-11109MEDIUMCampcodes Computer Sales and Inventory System us_edit.php sql injectionEPSS 0.5%CVE-2025-3708CRITICALLe-show Medical Practice Management System - SQL InjectionEPSS 0.5%CVE-2025-4488MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4487MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-1840MEDIUMESAFENET CDG updateorg.jsp sql injectionEPSS 0.5%CVE-2026-39948CRITICALCacti has SQL Injection via rfilter parameter in RLIKE clausesEPSS 0.5%CVE-2024-51672HIGHWordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-10444MEDIUMCampcodes Online Job Finder System advancesearch.php sql injectionEPSS 0.5%CVE-2024-40540MEDIUMmy-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept.EPSS 0.5%CVE-2025-4482MEDIUMProject Worlds Student Project Allocation System forgot_password_sql.php sql injectionEPSS 0.5%CVE-2026-7815HIGHpgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionEPSS 0.5%CVE-2024-40539MEDIUMmy-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user.EPSS 0.5%CVE-2023-49968HIGHCustomer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_departmeEPSS 0.5%CVE-2025-11309MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findDeptPage.do doFilter sql injectionEPSS 0.5%CVE-2024-3720MEDIUMTianwell Fire Intelligent Command Platform API Interface page sql injectionEPSS 0.5%CVE-2025-4484MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-10857MEDIUMCampcodes Point of Sale System POS login.php sql injectionEPSS 0.5%CVE-2025-4486MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4031MEDIUMPHPGurukul Pre-School Enrollment System aboutus.php sql injectionEPSS 0.5%CVE-2025-4005MEDIUMPHPGurukul COVID19 Testing Management System patient-report.php sql injectionEPSS 0.5%