Falhas do tipo CWE-89

11.960 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-67830CRITICALMura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.EPSS 0.3%CVE-2026-39196CRITICALDatadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::paEPSS 0.3%CVE-2025-15210MEDIUMcode-projects Refugee Food Management System editrefugee.php sql injectionEPSS 0.3%CVE-2025-7714HIGHTime Based SQLi in Global Medya's PHP CMSEPSS 0.3%CVE-2025-55732HIGHFrappe has the possibility of SQL Injection due to improper validationsEPSS 0.3%CVE-2026-40813HIGHUnauthenticated SQLi in getLiveValuesEPSS 0.3%CVE-2026-40810HIGHUnauthenticated SQLi in userinfo EndpointEPSS 0.3%CVE-2026-40817HIGHUnauthenticated SQLi in getAlarmProfiles functionEPSS 0.3%CVE-2025-5103MEDIUMUltimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post FunctionEPSS 0.3%CVE-2025-14966MEDIUMFastAdmin Backend Controller Backend.php selectpage sql injectionEPSS 0.3%CVE-2026-40818HIGHUnauthenticated SQLi in _mb24confi_getDevice function functionEPSS 0.3%CVE-2018-25424HIGHGate Pass Management System 2.1 SQL Injection via login-exec.phpEPSS 0.3%CVE-2026-37347CRITICALSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.EPSS 0.3%CVE-2026-40815HIGHUnauthenticated SQLi in _mb24api_getUserAccount functionEPSS 0.3%CVE-2025-50466HIGHOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestEPSS 0.3%CVE-2025-10437CRITICALSQLi in Exagate's Webpack Management SystemEPSS 0.3%CVE-2026-40811HIGHUnauthenticated SQLi in ssoabstractserviceEPSS 0.3%CVE-2026-27847CRITICALMissing authentication in Linksys MR9600, Linksys MX4200EPSS 0.3%CVE-2026-40814HIGHUnauthenticated SQLi in _mb24confi_getTagAlarm functionEPSS 0.3%CVE-2026-40819HIGHUnauthenticated SQLi in sync_data24 taskEPSS 0.3%