Fallos del tipo CWE-89

12.916 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-57656HIGHAn issue in the sqlc_add_distinct_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)EPSS 0.8%CVE-2023-49548HIGHCustomer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?EPSS 0.8%CVE-2024-0389MEDIUMSourceCodester Student Attendance System attendance_report.php sql injectionEPSS 0.8%CVE-2022-2680MEDIUMSourceCodester Church Management System login.php sql injectionEPSS 0.8%CVE-2024-9678MEDIUMAn SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries pEPSS 0.8%CVE-2022-2489MEDIUMSourceCodester Simple E-Learning System classRoom.php sql injectionEPSS 0.8%CVE-2022-2492MEDIUMSourceCodester Library Management System index.php sql injectionEPSS 0.8%CVE-2022-2491MEDIUMSourceCodester Library Management System lab.php sql injectionEPSS 0.8%CVE-2022-2679MEDIUMSourceCodester Interview Management System viewReport.php sql injectionEPSS 0.8%CVE-2022-2676MEDIUMSourceCodester Electronic Medical Records System POST Request sql injectionEPSS 0.8%CVE-2023-2823MEDIUMSourceCodester Class Scheduling System GET Parameter edit_subject.php sql injectionEPSS 0.8%CVE-2026-16462CRITICALSQL injection via unauthenticated GetGridData endpointEPSS 0.8%CVE-2022-2490MEDIUMSourceCodester Simple E-Learning System search.php sql injectionEPSS 0.8%CVE-2022-2677MEDIUMSourceCodester Apartment Visitor Management System index.php sql injectionEPSS 0.8%CVE-2022-33875MEDIUMAn improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, veEPSS 0.8%CVE-2023-3873HIGHCampcodes Beauty Salon Management System index.php sql injectionEPSS 0.8%CVE-2025-47785HIGHEMLOG SQL Injection VulnerabilityEPSS 0.8%CVE-2023-1365HIGHSourceCodester Online Pizza Ordering System ajax.php sql injectionEPSS 0.8%CVE-2024-8302MEDIUMdingfanzu CMS chpwd.php sql injectionEPSS 0.8%CVE-2022-47740CRITICALSeltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.EPSS 0.8%