Fallos del tipo CWE-89

12.819 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-29809CRITICALSQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafEPSS 10.5%CVE-2022-0592—MapSVG < 6.2.20 - Unauthenticated SQLiEPSS 10.4%CVE-2024-4443CRITICALBusiness Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields ParameterEPSS 10.4%CVE-2022-2135HIGHAdvantech iViewEPSS 10.2%CVE-2024-4295CRITICALEmail Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hashEPSS 10.2%CVE-2021-33177—The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the maliciouEPSS 10.1%CVE-2024-36680HIGHIn the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookCoEPSS 10.1%CVE-2022-0784—Title Experiments Free < 9.0.1 - Unauthenticated SQLiEPSS 10.1%CVE-2024-13973MEDIUMA post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to adminisEPSS 10.0%CVE-2024-52874HIGHIn Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks.EPSS 10.0%CVE-2024-50387CRITICALSMB ServiceEPSS 10.0%CVE-2023-39336CRITICALAn unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the intEPSS 10.0%CVE-2022-0948—Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLiEPSS 9.9%CVE-2017-17417—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. AuthentEPSS 9.8%CVE-2022-26887CRITICALDelta Electronics DIAEnergie SQL Injection in DIAE_HandlerTag_KID.ashxEPSS 9.7%CVE-2023-26876HIGHSQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id paEPSS 9.7%CVE-2021-43408MEDIUMDuplicate Post WordPress Plugin SQL Injection VulnerabilityEPSS 9.7%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.6%CVE-2022-22280—Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWaEPSS 9.5%CVE-2025-22206MEDIUMExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for JoomlaEPSS 9.5%