Fallos del tipo CWE-89

12.816 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-46502CRITICALOnline Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollmEPSS 13.7%CVE-2023-22959HIGHWebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).EPSS 13.7%CVE-2024-11728HIGHKiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL InjectionEPSS 13.6%CVE-2024-3495CRITICALCountry State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL InjectionEPSS 13.6%CVE-2026-23696CRITICALWindmill < 1.603.3 File Ownership Handling SQLi RCEEPSS 13.6%CVE-2020-35326CRITICALSQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0EPSS 13.6%CVE-2022-0867—ARPrice Lite < 3.6.1 - Unauthenticated SQLiEPSS 13.5%CVE-2022-0786—KiviCare < 2.3.9 - Unauthenticated SQLiEPSS 13.3%CVE-2026-1207MEDIUMPotential SQL injection via raster lookups on PostGISEPSS 13.3%CVE-2022-0781—Nirweb support < 2.8.2 - Unauthenticated SQLiEPSS 13.1%CVE-2024-27746CRITICALSQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to thEPSS 12.9%CVE-2025-27892MEDIUMShopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists bEPSS 12.9%CVE-2022-1768CRITICALRSVPMaker <= 9.3.2 - Unauthenticated SQL InjectionEPSS 12.9%CVE-2022-2840—Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLiEPSS 12.9%CVE-2023-35036CRITICALIn Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL inEPSS 12.8%CVE-2021-22658—Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'AdmEPSS 12.7%CVE-2025-15029CRITICALAn unauthenticated user is able to introduce SQL Injection using the Awie export moduleEPSS 12.7%CVE-2024-31458MEDIUMCacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in databaseEPSS 12.6%CVE-2021-24827—Asgaros Forum < 1.15.13 - Unauthenticated SQL InjectionEPSS 12.6%CVE-2023-4165MEDIUMTongda OA delete_seal.php sql injectionEPSS 12.4%