Fallos del tipo CWE-89

13.617 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-29275CRITICALSQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive iEPSS 5.0%CVE-2024-5678MEDIUMSQL InjectionEPSS 5.0%CVE-2025-49484HIGHExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for JoomlaEPSS 4.9%CVE-2020-14497—Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-contrEPSS 4.9%CVE-2024-39250CRITICALEfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interfEPSS 4.9%CVE-2022-2467HIGHSourceCodester Garage Management System login.php sql injectionEPSS 4.9%CVE-2023-40056HIGHSolarWinds Platform SQL Injection Remote Code Execution VulnerabilityEPSS 4.8%CVE-2024-1597CRITICALpgjdbc SQL Injection via line comment generationEPSS 4.8%CVE-2024-5487HIGHSQL InjectionEPSS 4.7%CVE-2021-24404—WP-Board <= 1.1 (beta) - Unauthenticated SQL InjectionEPSS 4.7%CVE-2024-5527HIGHSQL InjectionEPSS 4.7%CVE-2021-43789HIGHBlind SQLi using Search filters in PrestaShopEPSS 4.7%CVE-2020-29574CRITICALAn SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL sEPSS 4.7%KEVCVE-2022-46071CRITICALThere is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.EPSS 4.7%CVE-2022-38627CRITICALNortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injEPSS 4.7%CVE-2024-39887MEDIUMApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsEPSS 4.7%CVE-2021-24401—WP Domain Redirect <= 1.0 - Authenticated SQL InjectionEPSS 4.6%CVE-2021-24402—WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL InjectionEPSS 4.6%CVE-2016-9488—ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilitiesEPSS 4.6%CVE-2021-35049CRITICALCommand Injection Vulnerability in Fidelis Network and DeceptionEPSS 4.6%