Fallos del tipo CWE-89

13.095 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-3589MEDIUMSourceCodester Music Class Enrollment System manage_class.php sql injectionEPSS 0.6%CVE-2026-85652MEDIUMPhoto Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode AttributeEPSS 0.6%CVE-2025-13294CRITICALUnauthenticated SQL InjectionEPSS 0.6%CVE-2026-7048MEDIUMPhoto Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode AttributeEPSS 0.6%CVE-2026-16586MEDIUMContest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'EPSS 0.6%CVE-2024-7365MEDIUMSourceCodester Tracking Monitoring Management System manage_establishment.php sql injectionEPSS 0.6%CVE-2026-14029MEDIUMGroundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' ParameterEPSS 0.6%CVE-2024-7377MEDIUMSourceCodester Simple Realtime Quiz System view_result.php sql injectionEPSS 0.6%CVE-2023-50061CRITICALPrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().EPSS 0.6%CVE-2022-2672MEDIUMSourceCodester Garage Management System createUser.php sql injectionEPSS 0.6%CVE-2024-7362MEDIUMSourceCodester Tracking Monitoring Management System manage_user.php sql injectionEPSS 0.6%CVE-2026-11421MEDIUMERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterEPSS 0.6%CVE-2023-5785MEDIUMNetentsec NS-ASG Application Security Gateway addaddress_interpret.php sql injectionEPSS 0.6%CVE-2024-12794MEDIUMCodezips E-Commerce Site editorder.php sql injectionEPSS 0.6%CVE-2022-2673MEDIUMRigatur Online Booking and Hotel Management System POST Request login.php sql injectionEPSS 0.6%CVE-2026-9767MEDIUMThe School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' ParameterEPSS 0.6%CVE-2024-7499MEDIUMitsourcecode Airline Reservation System flights.php sql injectionEPSS 0.6%CVE-2023-1505MEDIUMSourceCodester E-Commerce System setDiscount.php sql injectionEPSS 0.6%CVE-2024-11968MEDIUMcode-projects Farmacia pagamento.php sql injectionEPSS 0.6%CVE-2026-4817MEDIUMMasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' ParametersEPSS 0.6%