Fallos del tipo CWE-89

12.895 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-3041MEDIUMNetentsec NS-ASG Application Security Gateway listloginfo.php sql injectionEPSS 0.8%CVE-2023-2690MEDIUMSourceCodester Personnel Property Equipment System GET Parameter returned_reuse_form.php sql injectionEPSS 0.8%CVE-2025-22974CRITICALSQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter iEPSS 0.8%CVE-2024-3040MEDIUMNetentsec NS-ASG Application Security Gateway list_crl_conf sql injectionEPSS 0.8%CVE-2025-62392MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 0.8%CVE-2021-1380MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2021-1407MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2021-1409MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2025-62385MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 0.8%CVE-2021-1408MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2025-62386MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 0.8%CVE-2023-1294HIGHSourceCodester File Tracker Manager System POST Parameter login.php sql injectionEPSS 0.8%CVE-2025-62391MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 0.8%CVE-2024-3003MEDIUMcode-projects Online Book System cart.php sql injectionEPSS 0.8%CVE-2023-1590MEDIUMSourceCodester Online Tours & Travels Management System currency.php exec sql injectionEPSS 0.8%CVE-2023-1589MEDIUMSourceCodester Online Tours & Travels Management System approve_delete.php exec sql injectionEPSS 0.8%CVE-2024-3797MEDIUMSourceCodester QR Code Bookmark System sql injectionEPSS 0.8%CVE-2024-3002MEDIUMcode-projects Online Book System description.php sql injectionEPSS 0.8%CVE-2024-2934MEDIUMSourceCodester Todo List in Kanban Board delete-todo.php sql injectionEPSS 0.8%CVE-2023-1441MEDIUMSourceCodester Automatic Question Paper Generator System GET Parameter view_course.php sql injectionEPSS 0.8%