Fallos del tipo CWE-89

12.993 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-8499MEDIUMcode-projects Online Medicine Guide cusfindambulence2.php sql injectionEPSS 0.6%CVE-2024-5395MEDIUMitsourcecode Online Student Enrollment System listofinstructor.php sql injectionEPSS 0.6%CVE-2022-2774MEDIUMSourceCodester Library Management System student.php sql injectionEPSS 0.6%CVE-2024-5588MEDIUMitsourcecode Learning Management System processscore.php sql injectionEPSS 0.6%CVE-2022-2801MEDIUMSourceCodester Automated Beer Parlour Billing System Login sql injectionEPSS 0.6%CVE-2024-33551CRITICALWordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerabilityEPSS 0.6%CVE-2024-5390MEDIUMitsourcecode Online Student Enrollment System listofstudent.php sql injectionEPSS 0.6%CVE-2024-6042MEDIUMitsourcecode Real Estate Management System property-detail.php sql injectionEPSS 0.6%CVE-2024-5392MEDIUMitsourcecode Online Student Enrollment System editSubject.php sql injectionEPSS 0.6%CVE-2024-7930MEDIUMSourceCodester Clinics Patient Management System get_packings.php sql injectionEPSS 0.6%CVE-2024-24110MEDIUMSQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the componEPSS 0.6%CVE-2017-20163MEDIUMRed Snapper NView Session.php mutate sql injectionEPSS 0.6%CVE-2024-3316MEDIUMSourceCodester Computer Laboratory Management System view_category.php sql injectionEPSS 0.6%CVE-2024-3251MEDIUMSourceCodester Computer Laboratory Management System sql injectionEPSS 0.6%CVE-2023-22491HIGHgatsby-transformer-remark vulnerable to unsanitized JavaScript code injection EPSS 0.6%CVE-2023-22378HIGHAuthenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2EPSS 0.6%CVE-2017-20173MEDIUMAlexRed contentmap contentmap.php Load sql injectionEPSS 0.6%CVE-2023-0883MEDIUMSourceCodester Online Pizza Ordering System index.php sql injectionEPSS 0.6%CVE-2024-2661HIGHBarcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL InjectionEPSS 0.6%CVE-2023-2108MEDIUMSourceCodester Judging Management System edit_contestant.php sql injectionEPSS 0.6%