Fallos del tipo CWE-89

12.948 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-1949MEDIUMPHPGurukul BP Monitoring Management System Change Password change-password.php sql injectionEPSS 0.7%CVE-2026-78612HIGHDimension SQL Injection in Scheduled ReportEPSS 0.7%CVE-2024-3617MEDIUMSourceCodester Kortex Lite Advocate Office Management System deactivate_case.php sql injectionEPSS 0.7%CVE-2024-3618MEDIUMSourceCodester Kortex Lite Advocate Office Management System activate_case.php sql injectionEPSS 0.7%CVE-2024-32493HIGHAn issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in theEPSS 0.7%CVE-2014-125058MEDIUMLearnMeSomeCodes project3 search.rb search_first_name sql injectionEPSS 0.7%CVE-2024-1317HIGHRSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL InjectionEPSS 0.7%CVE-2014-125045MEDIUMmeol1 index.php GetAnimal sql injectionEPSS 0.7%CVE-2024-10377MEDIUMESAFENET CDG DecryptApplicationService.java actionPassDecryptApplication1 sql injectionEPSS 0.7%CVE-2026-27005HIGHChartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)EPSS 0.7%CVE-2026-78614HIGHDimension SQL Injection in Audit ReportEPSS 0.7%CVE-2024-3418MEDIUMSourceCodester Online Courseware deactivateteach.php sql injectionEPSS 0.7%CVE-2024-7505MEDIUMitsourcecode Bike Delivery System contact_us_action.php sql injectionEPSS 0.7%CVE-2026-82526CRITICALR2R 3.6.6 SQL Injection via Vector Index Creation EndpointEPSS 0.7%CVE-2020-26627MEDIUMA Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database infoEPSS 0.7%CVE-2024-11256MEDIUM1000 Projects Portfolio Management System MCA login.php sql injectionEPSS 0.7%CVE-2012-10011MEDIUMHD FLV PLayer Plugin functions.php hd_update_media sql injectionEPSS 0.7%CVE-2014-125101MEDIUMPortfolio Gallery Plugin sql injectionEPSS 0.7%CVE-2024-5122MEDIUMSourceCodester Event Registration System sql injectionEPSS 0.7%CVE-2026-5490HIGHDriveLock SQL Injection Privilege Escalation VulnerabilityEPSS 0.7%