Fallos del tipo CWE-89

13.020 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-67917CRITICALzuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restoEPSS 0.6%CVE-2026-13262MEDIUMMajestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' ParameterEPSS 0.6%CVE-2024-2865CRITICALSQLi in Mergen Soft Quality Management SystemEPSS 0.6%CVE-2024-25526HIGHRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_incEPSS 0.6%CVE-2025-46179CRITICALA SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsaEPSS 0.6%CVE-2025-2662MEDIUMProject Worlds Online Time Table Generator studentdashboard.php sql injectionEPSS 0.6%CVE-2024-0729MEDIUMForU CMS cms_admin.php sql injectionEPSS 0.6%CVE-2024-6735MEDIUMitsourcecode Tailoring Management System setgeneral.php sql injectionEPSS 0.6%CVE-2024-25845CRITICALIn the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injeEPSS 0.6%CVE-2018-25057MEDIUMsimple_php_link_shortener index.php sql injectionEPSS 0.6%CVE-2024-0730MEDIUMProject Worlds Online Time Table Generator course_ajax.php sql injectionEPSS 0.6%CVE-2026-76006MEDIUMPhoto Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' ParameterEPSS 0.6%CVE-2024-8220MEDIUMitsourcecode Tailoring Management System staffedit.php sql injectionEPSS 0.6%CVE-2023-35911HIGHWordPress Contact Form Generator Plugin <= 2.6.0 is vulnerable to SQL InjectionEPSS 0.6%CVE-2024-8348MEDIUMSourceCodester Computer Laboratory Management System Master.php delete_category sql injectionEPSS 0.6%CVE-2024-57769HIGHJFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.EPSS 0.6%CVE-2025-30524CRITICALWordPress Product Catalog plugin <= 1.0.4 - SQL Injection vulnerabilityEPSS 0.6%CVE-2025-41374HIGHSQL injection vulnerability in Gandia Integra TotalEPSS 0.6%CVE-2024-13024MEDIUMCodezips Blood Bank Management System campaign.php sql injectionEPSS 0.6%CVE-2024-8335MEDIUMOpenRapid RapidCMS runlogon.php sql injectionEPSS 0.6%