Fallos del tipo CWE-89

12.989 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-30242CRITICALNS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php.EPSS 0.6%CVE-2023-3376CRITICALSQLi in Digital Strategys ZekiwebEPSS 0.6%CVE-2023-3716CRITICALSQLi in Oduyo Online Collection SoftwareEPSS 0.6%CVE-2022-2504CRITICALSQLi in SDD-BaroEPSS 0.6%CVE-2023-3046CRITICALSQLi in Biltay Technlogys ScientaEPSS 0.6%CVE-2025-59681HIGHAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySeEPSS 0.6%CVE-2023-30750HIGHWordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL InjectionEPSS 0.6%CVE-2023-1909MEDIUMPHPGurukul BP Monitoring Management System User Profile Update profile.php sql injectionEPSS 0.6%CVE-2023-30495HIGHWordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL InjectionEPSS 0.6%CVE-2024-2149MEDIUMCodeAstro Membership Management System settings.php sql injectionEPSS 0.6%CVE-2023-3791MEDIUMIBOS OA Personal Office Address Book export actionExport sql injectionEPSS 0.6%CVE-2023-49776CRITICALWordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL InjectionEPSS 0.6%CVE-2023-26033HIGHGentoo soko contains DoS attack based on SQL InjectionEPSS 0.6%CVE-2022-42923HIGHSQL injection in Forma LMSEPSS 0.6%CVE-2024-11722MEDIUMFrontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL InjectionEPSS 0.6%CVE-2022-35942CRITICALloopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` FilterEPSS 0.6%CVE-2023-5032MEDIUMOpenRapid RapidCMS article-edit-run.php sql injectionEPSS 0.6%CVE-2024-11241MEDIUMcode-projects Job Recruitment reset.php sql injectionEPSS 0.6%CVE-2022-45589HIGHAll versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks inEPSS 0.6%CVE-2025-32124HIGHWordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerabilityEPSS 0.6%