Fallos del tipo CWE-89

12.803 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-39361CRITICALUnauthenticated SQL Injection in graph_view.php in CactiEPSS 88.8%CVE-2017-18362CRITICALConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct acEPSS 86.8%KEVCVE-2021-24762—Perfect Survey < 1.5.2 - Unauthenticated SQL InjectionEPSS 86.8%CVE-2025-24799HIGHGLPI allows unauthenticated SQL injection through the inventory endpointEPSS 86.7%CVE-2023-30625HIGHrudder-server vulnerable to SQL InjectionEPSS 85.8%CVE-2025-57819CRITICALFreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEEPSS 85.5%KEVCVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.3%CVE-2023-25157CRITICALUnfiltered SQL Injection Vulnerabilities in GeoserverEPSS 85.2%CVE-2022-41142HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 85.0%CVE-2020-5722CRITICALThe HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An aEPSS 84.4%KEVCVE-2024-10400HIGHTutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterEPSS 83.1%CVE-2024-43468CRITICALMicrosoft Configuration Manager Remote Code Execution VulnerabilityEPSS 82.0%KEVCVE-2021-25114—Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL InjectionEPSS 81.8%CVE-2023-5151MEDIUMD-Link DAR-8000 autheditpwd.php sql injectionEPSS 81.5%CVE-2022-25148CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_idEPSS 80.9%CVE-2018-12464CRITICALUnauthenticated SQL injection in Micro Focus Secure Messaging GatewayEPSS 80.7%CVE-2024-2876CRITICALIcegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL InjectionEPSS 80.6%CVE-2024-8503CRITICALVICIdial Unauthenticated SQL InjectionEPSS 80.2%CVE-2025-32969CRITICALorg.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIEPSS 79.4%CVE-2021-24931—Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL InjectionEPSS 78.8%