Fallos del tipo CWE-89

12.949 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-37472HIGHQuery injection in Knowage serverEPSS 0.7%CVE-2024-25309HIGHCode-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher_login.php.EPSS 0.7%CVE-2024-30871HIGHnetentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.EPSS 0.7%CVE-2026-54368HIGHCentreStack < 17.4 SQL Injection via x-glad-filter HeaderEPSS 0.7%CVE-2023-1547CRITICALSQLi in Elra Computers ParkmatikEPSS 0.7%CVE-2023-5285MEDIUMTongda OA 2017 delete.php sql injectionEPSS 0.7%CVE-2024-13006MEDIUM1000 Projects Human Resource Management System employeeview.php sql injectionEPSS 0.7%CVE-2025-46101CRITICALSQL Injection vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) version befEPSS 0.7%CVE-2023-1765CRITICALSQLi in PanonEPSS 0.7%CVE-2026-53448HIGHCoturn: SQL Injection in HTTPS Admin Panel Delete OperationsEPSS 0.7%CVE-2023-0560MEDIUMSourceCodester Online Tours & Travels Management System practice_pdf.php sql injectionEPSS 0.7%CVE-2023-1276MEDIUMSUL1SS_shop Order.php sql injectionEPSS 0.7%CVE-2015-10039MEDIUMdobos domino EntityFactory.cs sql injectionEPSS 0.7%CVE-2025-32867HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32865HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32866HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32852HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32848HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32854HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32853HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%