Falhas do tipo CWE-89

12.010 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-54720CRITICALWordPress Nest Addons Plugin <= 1.6.3 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-25514MEDIUMSeacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.EPSS 0.3%CVE-2024-34993MEDIUMIn the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShEPSS 0.3%CVE-2025-47490HIGHWordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-47640CRITICALWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-52720CRITICALWordPress Super Store Finder Plugin <= 7.5 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39389CRITICALWordPress AnalyticsWP <= 2.1.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-12920MEDIUMCookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' ParameterEPSS 0.3%CVE-2025-48274CRITICALWordPress WP Job Portal plugin <= 2.3.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-39502CRITICALWordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-10762MEDIUMkuaifan DooTask UsersController.php sql injectionEPSS 0.3%CVE-2025-39386CRITICALWordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerabilityEPSS 0.3%CVE-2019-25638HIGHMeeplace Business Review Script Lastest SQL Injection via addclick.phpEPSS 0.3%CVE-2025-68055HIGHWordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-12620MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` ParameterEPSS 0.3%CVE-2026-32358HIGHWordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-58439HIGHERP: Possibility of SQL injection due to missing validationEPSS 0.3%CVE-2026-45439CRITICALWordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52830CRITICALWordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-13385MEDIUMBookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' ParameterEPSS 0.3%