Fallos del tipo CWE-89

12.989 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-4226MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System add-computer.php sql injectionEPSS 0.6%CVE-2025-3829MEDIUMPHPGurukul Men Salon Management System sales-reports-detail.php sql injectionEPSS 0.6%CVE-2024-42885CRITICALSQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jspEPSS 0.6%CVE-2025-3828MEDIUMPHPGurukul Men Salon Management System view-appointment.php sql injectionEPSS 0.6%CVE-2024-54811CRITICALA SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL EPSS 0.6%CVE-2023-2411MEDIUMSourceCodester AC Repair and Services System view_inquiry.php sql injectionEPSS 0.6%CVE-2025-6959MEDIUMCampcodes Employee Management System eloginwel.php sql injectionEPSS 0.6%CVE-2023-1608MEDIUMZhong Bang CRMEB Java list getAdminList sql injectionEPSS 0.6%CVE-2025-67146CRITICALMultiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, EPSS 0.6%CVE-2023-2409MEDIUMSourceCodester AC Repair and Services System view_service.php sql injectionEPSS 0.6%CVE-2023-2408MEDIUMSourceCodester AC Repair and Services System view.php sql injectionEPSS 0.6%CVE-2025-6960MEDIUMCampcodes Employee Management System empproject.php sql injectionEPSS 0.6%CVE-2024-0651MEDIUMPHPGurukul Company Visitor Management System search-visitor.php sql injectionEPSS 0.6%CVE-2022-50592CRITICALAdvantech iView < v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCEEPSS 0.6%CVE-2024-28613CRITICALSQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive informaEPSS 0.6%CVE-2023-2410MEDIUMSourceCodester AC Repair and Services System view_booking.php sql injectionEPSS 0.6%CVE-2022-50595CRITICALAdvantech iView < v5.7.04 Build 6425 ztp_search_value Parameter SQL Injection RCEEPSS 0.6%CVE-2023-2413MEDIUMSourceCodester AC Repair and Services System manage_booking.php sql injectionEPSS 0.6%CVE-2025-40677HIGHSQL injection vulnerability in Summar Software´s Portal del EmpleadoEPSS 0.6%CVE-2025-13344MEDIUMSourceCodester Train Station Ticketing System ajax.php sql injectionEPSS 0.6%