Falhas do tipo CWE-89

11.949 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2024-12245HIGHBlind SQL Injection in LogoutEPSS 0.3%CVE-2025-15435MEDIUMYonyou KSOA work_update.jsp sql injectionEPSS 0.3%CVE-2025-59557CRITICALWordPress Learts Addons Plugin < 1.7.5 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-6919CRITICALSQLi in Cats Informatics' AykomeEPSS 0.3%CVE-2026-15300CRITICALGEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' ParametersEPSS 0.3%CVE-2026-4826MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injectionEPSS 0.3%CVE-2026-57628HIGHWordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-2890MEDIUMtagDiv Opt-In Builder <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId ParameterEPSS 0.3%CVE-2025-6908MEDIUMPHPGurukul Old Age Home Management System edit-services.php sql injectionEPSS 0.3%CVE-2025-53468HIGHWordPress Wp tabber widget Plugin <= 4.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2023-42807MEDIUMFrappe LMS SQL Injection Issue on People PageEPSS 0.3%CVE-2025-22290CRITICALWordPress LTL Freight Quotes – FreightQuote Edition Plugin <= 2.3.11 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-2117MEDIUMBeijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System reportCenter.do electricDocList sql injectionEPSS 0.3%CVE-2025-27312HIGHWordPress WP Sitemap plugin <= 1.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-6911MEDIUMPHPGurukul Student Record System manage-subjects.php sql injectionEPSS 0.3%CVE-2018-25371HIGHmooSocial Store Plugin 2.6 SQL Injection via product parameterEPSS 0.3%CVE-2024-12276MEDIUMUltimate Member <= 2.9.2 - Authenticated SQL InjectionEPSS 0.3%CVE-2025-11113MEDIUMCodeAstro Online Leave Application signup.php sql injectionEPSS 0.3%CVE-2025-59939HIGHWeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`.EPSS 0.3%CVE-2025-53648MEDIUMApache Gravitino: SQL misconfiguration can access or truncate filesEPSS 0.3%