Fallos del tipo CWE-89

12.961 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-5896MEDIUMSourceCodester Employee and Visitor Gate Pass Logging System save_users sql injectionEPSS 0.7%CVE-2024-6111MEDIUMitsourcecode Pool of Bethesda Online Reservation System login.php sql injectionEPSS 0.7%CVE-2024-12787MEDIUM1000 Projects Attendance Tracking Management System check_student_login.php sql injectionEPSS 0.7%CVE-2024-25220CRITICALTask Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php.EPSS 0.7%CVE-2025-61023HIGHAn issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craftedEPSS 0.7%CVE-2022-47430MEDIUMWordPress The School Management – Education & Learning Management Plugin <= 4.1 is vulnerable to SQL InjectionEPSS 0.7%CVE-2021-4308MEDIUMWebPA sql injectionEPSS 0.7%CVE-2016-15021MEDIUMnickzren alsdb sql injectionEPSS 0.7%CVE-2023-38391MEDIUMWordPress Onepage Builder – Easiest Landing Page Builder For WordPress Plugin <= 2.4.1 is vulnerable to SQL InjectionEPSS 0.7%CVE-2025-61028HIGHAn issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.7%CVE-2013-10013MEDIUMBricco Authenticator Plugin DBAuthenticator.java compare sql injectionEPSS 0.7%CVE-2025-61018HIGHAn issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via EPSS 0.7%CVE-2023-33924HIGHWordPress SIS Handball Plugin <= 1.0.45 is vulnerable to SQL InjectionEPSS 0.7%CVE-2023-27605MEDIUMWordPress WP Reroute Email Plugin <= 1.4.6 is vulnerable to SQL InjectionEPSS 0.7%CVE-2021-4298MEDIUMHesburgh Libraries of Notre Dame Sipity search_criteria_for_works_parameter.rb SearchCriteriaForWorksParameter sql injectionEPSS 0.7%CVE-2024-3619MEDIUMSourceCodester Kortex Lite Advocate Office Management System addcase_stage.php sql injectionEPSS 0.7%CVE-2023-40207HIGHWordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to SQL InjectionEPSS 0.7%CVE-2025-61020HIGHAn issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) viaEPSS 0.7%CVE-2023-40215HIGHWordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL InjectionEPSS 0.7%CVE-2018-25066MEDIUMPeterMu nodebatis sql injectionEPSS 0.7%