Fallos del tipo CWE-89

12.989 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-34162CRITICALBian Que Feijiu Intelligent Emergency and Quality Control System SQL Injection via GetLyfsByParamsEPSS 0.6%CVE-2024-0594HIGHAwesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL InjectionEPSS 0.6%CVE-2024-1878MEDIUMSourceCodester Employee Management System myprofile.php sql injectionEPSS 0.6%CVE-2017-20172MEDIUMridhoq soundslike songs.py get_song_relations sql injectionEPSS 0.6%CVE-2025-41375CRITICALSQL Injection in LimesurveyEPSS 0.6%CVE-2016-15034MEDIUMDynacase Webdesk freedomrss_search.php freedomrss_search sql injectionEPSS 0.6%CVE-2017-20168MEDIUMjfm-so piWallet api.php sql injectionEPSS 0.6%CVE-2024-0289MEDIUMKashipara Food Management System stock_entry_submit.php sql injectionEPSS 0.6%CVE-2022-27485MEDIUMA improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox versiEPSS 0.6%CVE-2024-30990CRITICALSQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute aEPSS 0.6%CVE-2023-39292CRITICALA SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious acEPSS 0.6%CVE-2024-54280CRITICALWordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerabilityEPSS 0.6%CVE-2024-24017HIGHA SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort paramEPSS 0.6%CVE-2026-33917HIGHOpenEMR has SQL Injection in CAMOS FormEPSS 0.6%CVE-2024-5311CRITICALDigiWin EasyFlow .NET - SQL InjectionEPSS 0.6%CVE-2023-4182HIGHSourceCodester Inventory Management System edit_sell.php sql injectionEPSS 0.6%CVE-2023-4184HIGHSourceCodester Inventory Management System sell_return.php sql injectionEPSS 0.6%CVE-2024-6190MEDIUMitsourcecode Farm Management System Login index.php sql injectionEPSS 0.6%CVE-2025-22980MEDIUMA SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan formEPSS 0.6%CVE-2024-7026HIGHSQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking SoftwareEPSS 0.6%