Fallos del tipo CWE-89

13.605 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-28040HIGHDelta Electronics DIAEnergie SQL injectionEPSS 8.5%CVE-2024-29830HIGHAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same EPSS 8.5%CVE-2024-28891HIGHDelta Electronics DIAEnergie SQL injectionEPSS 8.5%CVE-2024-29828HIGHAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same EPSS 8.5%CVE-2024-23975HIGHDelta Electronics DIAEnergie SQL injectionEPSS 8.5%CVE-2024-25937HIGHDelta Electronics DIAEnergie SQL injectionEPSS 8.5%CVE-2024-23494HIGHDelta Electronics DIAEnergie SQL injectionEPSS 8.5%CVE-2024-29846HIGHAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same EPSS 8.5%CVE-2023-5152MEDIUMD-Link DAR-7000/DAR-8000 importexport.php sql injectionEPSS 8.5%CVE-2026-26988CRITICALLibreNMS: SQL Injection in ajax_table.php spreads through a covert data streamEPSS 8.4%CVE-2026-26263HIGHGLPI has an Unauthenticated SQL Injection via Search engineEPSS 8.4%CVE-2021-24849—WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL InjectionEPSS 8.4%CVE-2023-1545HIGH SQL Injection in nilsteampassnet/teampassEPSS 8.4%CVE-2022-0769—Users Ultra <= 3.1.0 - Unauthenticated SQL InjectionEPSS 8.3%CVE-2024-36837MEDIUMSQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in theEPSS 8.3%CVE-2024-29829HIGHAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same EPSS 8.2%CVE-2021-39165HIGHUnauthenticated SQL InjectionEPSS 8.2%CVE-2023-1934CRITICALThe PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerabiEPSS 8.1%CVE-2022-41773HIGHDelta Electronics DIAEnergieEPSS 8.1%CVE-2022-1057—Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQLiEPSS 8.0%