Fallos del tipo CWE-89

12.949 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-32849HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2015-10039MEDIUMdobos domino EntityFactory.cs sql injectionEPSS 0.7%CVE-2025-32872HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32854HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32848HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32865HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2026-31840CRITICALParse Server has a SQL injection via dot-notation field name in PostgreSQLEPSS 0.7%CVE-2026-3222HIGHWP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' ParameterEPSS 0.7%CVE-2025-32867HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2026-60090CRITICALPraisonAI before 4.6.78 SQL/CQL Injection via vector dimensionEPSS 0.7%CVE-2024-56042CRITICALWordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerabilityEPSS 0.7%CVE-2024-8567MEDIUMitsourcecode Payroll Management System ajax.php sql injectionEPSS 0.7%CVE-2023-3023HIGHWP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'EPSS 0.7%CVE-2024-7947MEDIUMSourceCodester Point of Sales and Inventory Management System login.php sql injectionEPSS 0.7%CVE-2023-28883CRITICALIn Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.EPSS 0.7%CVE-2023-7126MEDIUMcode-projects Automated Voting System Admin Login sql injectionEPSS 0.7%CVE-2023-7128MEDIUMcode-projects Voting System Admin Login sql injectionEPSS 0.7%CVE-2024-7946MEDIUMitsourcecode Online Blood Bank Management System User Signup register.php sql injectionEPSS 0.7%CVE-2023-32741HIGHWordPress Contact Form to Any API Plugin <= 1.1.2 is vulnerable to SQL InjectionEPSS 0.7%CVE-2023-7138MEDIUMcode-projects Client Details System HTTP POST Request admin sql injectionEPSS 0.7%