Fallos del tipo CWE-89

12.904 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-29822CRITICALFeathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injectionEPSS 0.8%CVE-2023-1311MEDIUMSourceCodester Friendly Island Pizza Website and Ordering System GET Parameter large.php sql injectionEPSS 0.8%CVE-2023-2074MEDIUMCampcodes Online Traffic Offense Management System Master.php sql injectionEPSS 0.8%CVE-2023-2037MEDIUMCampcodes Video Sharing Website watch.php sql injectionEPSS 0.8%CVE-2023-1039HIGHSourceCodester Class and Exam Timetabling System POST Parameter index3.php sql injectionEPSS 0.8%CVE-2023-1301MEDIUMSourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injectionEPSS 0.8%CVE-2022-2422CRITICALFeathers - SQL injection via attribute aliasesEPSS 0.8%CVE-2026-9668MEDIUMSQL injection vulnerability in ZTE SCP productEPSS 0.8%CVE-2023-43794MEDIUMSQL Injection in nocodbEPSS 0.8%CVE-2023-1300MEDIUMSourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injectionEPSS 0.8%CVE-2023-5428HIGHImage vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-30850HIGHPimcore SQL Injection Vulnerability in Admin Translations APIEPSS 0.8%CVE-2023-5431HIGHLeft right image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5430HIGHJquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-30849HIGHPimcore vulnerable to SQL Injection in Translation Export APIEPSS 0.8%CVE-2024-12788MEDIUMCodezips Technical Discussion Forum signinpost.php sql injectionEPSS 0.8%CVE-2024-31010HIGHSQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.EPSS 0.8%CVE-2023-5466HIGHWp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-27733HIGHDedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.EPSS 0.8%CVE-2023-5429HIGHInformation Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%