Fallos del tipo CWE-89

12.967 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-54790HIGHA SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to execEPSS 0.7%CVE-2026-78315HIGHDIAEnergie - SQL InjectionEPSS 0.7%CVE-2026-73069CRITICALTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL ExecutionEPSS 0.7%CVE-2026-78314HIGHDIAEnergie - SQL InjectionEPSS 0.7%CVE-2025-66335MEDIUMApache Doris MCP Server: MCP SQL injectEPSS 0.7%CVE-2026-56287HIGHApache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File DisclosureEPSS 0.7%CVE-2024-7273MEDIUMitsourcecode Alton Management System search.php sql injectionEPSS 0.7%CVE-2025-32856HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2024-35354CRITICALA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.7%CVE-2025-36588HIGHDell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL InjEPSS 0.7%CVE-2023-47558HIGHWordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to SQL InjectionEPSS 0.7%CVE-2025-32860HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2024-35355CRITICALA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.7%CVE-2024-34256CRITICALOFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.EPSS 0.7%CVE-2025-32861HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32855HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32859HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32863HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2026-26794HIGHGL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows EPSS 0.7%CVE-2025-32858HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%