Falhas do tipo CWE-89

12.012 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.3%CVE-2025-32924HIGHWordPress Revy plugin <= 2.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2018-25339HIGHZechat 1.5 SQL Injection via v parameter (time-based blind)EPSS 0.3%CVE-2025-32301HIGHWordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2018-25205HIGHASP.NET jVideo Kit 1.0 SQL Injection via query ParameterEPSS 0.3%CVE-2019-25641HIGHNetartmedia Vlog System Lastest SQL Injection via email ParameterEPSS 0.3%CVE-2025-52822HIGHWordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32306HIGHWordPress Radio Player Shoutcast & Icecast theme <= 4.4.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2019-25642HIGHBootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact ModulesEPSS 0.3%CVE-2025-5673MEDIUMBlog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` ParameterEPSS 0.3%CVE-2025-32287HIGHWordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-2122MEDIUMXiaopi Panel WAF Firewall demo.php sql injectionEPSS 0.3%CVE-2025-32307HIGHWordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-47651HIGHWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-31926HIGHWordPress Sticky Radio Player plugin <= 3.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-15736HIGHMultiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemyEPSS 0.3%CVE-2025-52821HIGHWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39355HIGHWordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32290HIGHWordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-65707HIGHLikeshop 3.0.5 Authenticated SQL Injection via adjustAccount EndpointEPSS 0.3%