Falhas do tipo CWE-89

12.012 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-10048MEDIUMMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2021-47956HIGHEgavilanMedia PHPCRUD 1.0 SQL Injection via firstnameEPSS 0.3%CVE-2026-26697MEDIUMcode-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=.EPSS 0.3%CVE-2019-25713HIGHMyT-PM 1.5.1 SQL Injection via Charge[group_total] ParameterEPSS 0.3%CVE-2026-26698MEDIUMcode-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.EPSS 0.3%CVE-2018-25418HIGHAiOPMSD Final 1.0.0 SQL Injection via year.phpEPSS 0.3%CVE-2020-37242HIGHWordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidxEPSS 0.3%CVE-2026-30881HIGHChamilo LMS: SQL Injection in the statistics AJAX endpointEPSS 0.3%CVE-2015-10146MEDIUMThumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2022-41680HIGHSQL Injection in Forma LMSEPSS 0.3%CVE-2026-25418HIGHWordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-40524HIGHFrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()EPSS 0.3%CVE-2025-14222MEDIUMcode-projects Employee Profile Management System print_personnel_report.php sql injectionEPSS 0.3%CVE-2025-9947MEDIUMCustom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` ParameterEPSS 0.3%CVE-2021-47928HIGHOpencart TMD Vendor System 3.x Blind SQL Injection via product routeEPSS 0.3%CVE-2020-37244HIGHWordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidxEPSS 0.3%CVE-2026-3786MEDIUMEasyCMS Request Parameter RbacuserAction.class.php sql injectionEPSS 0.3%CVE-2026-11488MEDIUMcode-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injectionEPSS 0.3%CVE-2025-52829CRITICALWordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-52831CRITICALWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%