Falhas do tipo CWE-89

12.006 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-63234CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.3%CVE-2026-4304HIGHWeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' ParameterEPSS 0.3%CVE-2026-42727CRITICALWordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-14363MEDIUMCargo Extension: SQLi in Special:DrilldownEPSS 0.3%CVE-2026-14475MEDIUMCookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' ParameterEPSS 0.3%CVE-2026-63233CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.3%CVE-2026-22195HIGHGestSup < 3.2.60 SQL Injection in Search BarEPSS 0.3%CVE-2026-39111HIGHSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the EPSS 0.3%CVE-2025-12861MEDIUMDedeBIZ spec_add.php sql injectionEPSS 0.3%CVE-2025-12927MEDIUMDedeBIZ archives_add.php sql injectionEPSS 0.3%CVE-2025-56381MEDIUMERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint viaEPSS 0.3%CVE-2025-56380MEDIUMFrappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_valueEPSS 0.3%CVE-2018-25172HIGHPedidos 1.0 SQL Injection via load_proveedores.phpEPSS 0.3%CVE-2026-33531MEDIUMInvenTree has Path Traversal In Report TemplatesEPSS 0.3%CVE-2025-12860MEDIUMDedeBIZ freelist_main.php sql injectionEPSS 0.3%CVE-2025-5783MEDIUMPHPGurukul Employee Record Management System editmyexp.php sql injectionEPSS 0.3%CVE-2025-12859MEDIUMDedeBIZ templets_one_edit.php sql injectionEPSS 0.3%CVE-2025-47490HIGHWordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39389CRITICALWordPress AnalyticsWP <= 2.1.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-65877HIGHLvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in cEPSS 0.3%