Falhas do tipo CWE-89

12.013 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-40846HIGHAuthenticated SQLi in system viewEPSS 0.3%CVE-2026-40842HIGHAuthenticated SQLi in getWidgetTags functionEPSS 0.3%CVE-2019-25431HIGHdelpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetimeEPSS 0.3%CVE-2026-40839HIGHAuthenticated SQLi in getComponentScalings functionEPSS 0.3%CVE-2026-40843HIGHAuthenticated SQLi in alarming viewEPSS 0.3%CVE-2019-25462HIGHWeb Ofisi Rent a Car v3 SQL Injection via klima ParameterEPSS 0.3%CVE-2026-40832HIGHAuthenticated SQLi in getDevicegroups functionEPSS 0.3%CVE-2026-8082HIGHBpost Shipping Platform < 3.2.3 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2025-30998HIGHWordPress WP Links Page plugin <= 4.9.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-13011MEDIUMERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' ParameterEPSS 0.3%CVE-2026-15267MEDIUMTaskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2025-54026HIGHWordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-58993HIGHWordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-52820HIGHWordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-63724MEDIUMSQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php.EPSS 0.3%CVE-2025-56699MEDIUMSQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated EPSS 0.3%CVE-2025-49033HIGHWordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32466MEDIUMExtension - rsjoomla.com - SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for JoomlaEPSS 0.3%CVE-2025-64366HIGHWordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-55212MEDIUMDNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspxEPSS 0.3%