Fallos del tipo CWE-89

12.989 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-8855CRITICALWordPress Auction <= 3.7 - Editor+ SQL InjectionEPSS 0.6%CVE-2024-23763CRITICALSQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiersEPSS 0.6%CVE-2025-26198CRITICALCloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails tEPSS 0.6%CVE-2024-33544CRITICALWordPress WZone plugin <= 14.0.10 - Unauthenticated SQL Injection vulnerabilityEPSS 0.6%CVE-2026-34099CRITICALGuardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.phpEPSS 0.6%CVE-2013-10019MEDIUMOCLC-Research OAICat sql injectionEPSS 0.6%CVE-2024-25525CRITICALRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownloadEPSS 0.6%CVE-2024-25520CRITICALRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.asEPSS 0.6%CVE-2024-5048MEDIUMcode-projects Budget Management index.php sql injectionEPSS 0.6%CVE-2022-47072CRITICALSQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter iEPSS 0.6%CVE-2008-10004MEDIUMEmail Registration email_registration.module email_registration_user sql injectionEPSS 0.6%CVE-2017-20168MEDIUMjfm-so piWallet api.php sql injectionEPSS 0.6%CVE-2015-10076MEDIUMdimtion Shaarlier Tag TagsSource.java createTag sql injectionEPSS 0.6%CVE-2017-20172MEDIUMridhoq soundslike songs.py get_song_relations sql injectionEPSS 0.6%CVE-2024-0594HIGHAwesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL InjectionEPSS 0.6%CVE-2016-15034MEDIUMDynacase Webdesk freedomrss_search.php freedomrss_search sql injectionEPSS 0.6%CVE-2024-2514HIGHMAGESH-K21 Online-College-Event-Hall-Reservation-System login.php sql injectionEPSS 0.6%CVE-2024-0289MEDIUMKashipara Food Management System stock_entry_submit.php sql injectionEPSS 0.6%CVE-2025-2927MEDIUMESAFENET CDG getFileTypeList.jsp sql injectionEPSS 0.6%CVE-2024-25248CRITICALSQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the EPSS 0.6%