Fallos del tipo CWE-89

12.989 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-3620MEDIUMSourceCodester Kortex Lite Advocate Office Management System adds.php sql injectionEPSS 0.6%CVE-2023-23007HIGHAn issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function nodEPSS 0.6%CVE-2024-4215HIGHThe Multi Factor Authentication bypass vulnerability in pgAdmin 4EPSS 0.6%CVE-2025-8220MEDIUMEngeman Web Password Recovery RecoveryPass sql injectionEPSS 0.6%CVE-2024-0884MEDIUMSourceCodester Online Tours & Travels Management System payment.php exec sql injectionEPSS 0.6%CVE-2024-1926MEDIUMSourceCodester Free and Open Source Inventory Management System search_sales_report.php sql injectionEPSS 0.6%CVE-2023-7129MEDIUMcode-projects Voting System Voters Login sql injectionEPSS 0.6%CVE-2024-2154MEDIUMSourceCodester Online Mobile Management Store view_product.php sql injectionEPSS 0.6%CVE-2023-7155MEDIUMSourceCodester Free and Open Source Inventory Management System edit_product.php sql injectionEPSS 0.6%CVE-2022-44580CRITICALWordPress Plugin for Google Reviews Plugin <= 2.2.3 is vulnerable to SQL InjectionEPSS 0.6%CVE-2024-3621MEDIUMSourceCodester Kortex Lite Advocate Office Management System register_case.php sql injectionEPSS 0.6%CVE-2025-44033CRITICALSQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaraEPSS 0.6%CVE-2025-30765HIGHWordPress FlexStock plugin <= 3.13.1 - SQL Injection VulnerabilityEPSS 0.6%CVE-2024-9797MEDIUMcode-projects Blood Bank System register.php sql injectionEPSS 0.6%CVE-2024-10336MEDIUMSourceCodeHero Clothes Recommendation System Admin Login Page index.php sql injectionEPSS 0.6%CVE-2025-11902MEDIUMyanyutao0402 ChanCMS findField sql injectionEPSS 0.6%CVE-2025-11904MEDIUMyanyutao0402 ChanCMS hasUse sql injectionEPSS 0.6%CVE-2022-47445HIGHWordPress Be POPIA Compliant Plugin <= 1.2.0 is vulnerable to SQL InjectionEPSS 0.6%CVE-2025-11903MEDIUMyanyutao0402 ChanCMS update sql injectionEPSS 0.6%CVE-2021-29099MEDIUMThere is a SQL injection vulnerability in ArcGIS ServerEPSS 0.6%