Fallos del tipo CWE-89

11.885 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-43640MEDIUMTaxonWorks SQL injection vulnerabilityEPSS 0.5%CVE-2026-26794HIGHGL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows EPSS 0.5%CVE-2024-12416HIGHWoomotiv <= 3.6.1 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2024-10297MEDIUMPHPGurukul Medical Card Generation System Managecard Edit Image Page changeimage.php sql injectionEPSS 0.5%CVE-2019-25506HIGHFreeSMS 2.1.2 Authentication Bypass via SQL InjectionEPSS 0.5%CVE-2025-14620MEDIUMcode-projects Student File Management System login_query.php sql injectionEPSS 0.5%CVE-2026-25544CRITICALPayload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite AdaptersEPSS 0.5%CVE-2024-48465CRITICALThe MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameterEPSS 0.5%CVE-2024-9081MEDIUMSourceCodester Online Eyewear Shop view_category.php sql injectionEPSS 0.5%CVE-2024-8251MEDIUMPrisma Injection in mintplex-labs/anything-llmEPSS 0.5%CVE-2024-6417MEDIUMSourceCodester Simple Online Bidding System sql injectionEPSS 0.5%CVE-2019-25499HIGHSimple Job Script SQL Injection via get_job_applications_ajax.phpEPSS 0.5%CVE-2025-14619MEDIUMcode-projects Student File Management System login_query.php sql injectionEPSS 0.5%CVE-2025-22519HIGHWordPress eDoc Easy Tables Plugin <= 1.29 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-7702HIGHContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory FunctionEPSS 0.5%CVE-2024-44756CRITICALNUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogEPSS 0.5%CVE-2024-29730CRITICALMultiple vulnerabilities in SportsNETEPSS 0.5%CVE-2024-7841MEDIUMSourceCodester Clinics Patient Management System check_user_name.php sql injectionEPSS 0.5%CVE-2024-29725CRITICALMultiple vulnerabilities in SportsNETEPSS 0.5%CVE-2026-33539HIGHParse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapterEPSS 0.5%