Fallos del tipo CWE-89

12.992 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-33273CRITICALSQL injection vulnerability in shipup before v.3.3.0 allows a remote attacker to escalate privileges via the getShopID function.EPSS 0.6%CVE-2024-57034CRITICALWeGIA < 3.2.0 is vulnerable to SQL Injection in query_geracao_auto.php via the query parameter.EPSS 0.6%CVE-2023-5268MEDIUMDedeBIZ makehtml_taglist_action.php sql injectionEPSS 0.6%CVE-2024-6731MEDIUMSourceCodester Student Study Center Desk Management System Master.php sql injectionEPSS 0.6%CVE-2024-57031CRITICALWeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.EPSS 0.6%CVE-2026-78613HIGHDimension SQL Injection in Log ViewerEPSS 0.6%CVE-2024-0405HIGHBurst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL InjectionEPSS 0.6%CVE-2024-25509CRITICALRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_fileEPSS 0.6%CVE-2024-25511CRITICALRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.asEPSS 0.6%CVE-2022-4889MEDIUMvisegripped Stracker api.php getHistory sql injectionEPSS 0.6%CVE-2024-2566HIGHFujian Kelixin Communication Command and Dispatch Platform get_extension_yl.php sql injectionEPSS 0.6%CVE-2024-1251MEDIUMTongda OA 2017 delete.php sql injectionEPSS 0.6%CVE-2022-35956MEDIUMupdate_by_case before 0.1.3 vulnerable to sql injectionEPSS 0.6%CVE-2023-51805HIGHSQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain sensitive information via the getFormKey pEPSS 0.6%CVE-2024-25507CRITICALRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.asEPSS 0.6%CVE-2026-23969MEDIUMApache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function FilteringEPSS 0.6%CVE-2023-2567HIGHAuthenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0EPSS 0.6%CVE-2022-44790HIGHInterspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform EPSS 0.6%CVE-2023-0016CRITICALSQL Injection vulnerability in SAP Business Planning and Consolidation MSEPSS 0.6%CVE-2026-17346HIGHpgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)EPSS 0.6%