Weaknesses of type CWE-89

12,877 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-31628HIGHAn issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQLEPSS 0.9%CVE-2023-31626HIGHAn issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted EPSS 0.9%CVE-2023-31614HIGHAn issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoSEPSS 0.9%CVE-2023-31609HIGHAn issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cEPSS 0.9%CVE-2023-31625HIGHAn issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.9%CVE-2023-31608HIGHAn issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafteEPSS 0.9%CVE-2023-31621HIGHAn issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted EPSS 0.9%CVE-2023-31629HIGHAn issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crEPSS 0.9%CVE-2023-31612HIGHAn issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.9%CVE-2023-31617HIGHAn issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.9%CVE-2023-4543MEDIUMIBOS OA export&contactids=x sql injectionEPSS 0.9%CVE-2023-27871HIGHIBM Aspera Faspex information disclosureEPSS 0.9%CVE-2023-29095HIGHWordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-22319HIGHA sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network EPSS 0.9%CVE-2023-20010HIGHA vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications EPSS 0.9%CVE-2023-34168HIGHWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-4928HIGHSQL Injection in instantsoft/icms2EPSS 0.9%CVE-2023-27233HIGHPiwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.EPSS 0.9%CVE-2022-40315CRITICALA limited SQL injection risk was identified in the "browse list of users" site administration page.EPSS 0.9%CVE-2023-5004CRITICALHospital-management-system-in-php 378c157 - Blind SQL InjectionEPSS 0.9%