Fallos del tipo CWE-89

13.617 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2021-22859CRITICALEIC e-document system - SQL InjectionEPSS 3.8%CVE-2023-6655HIGHHongjing e-HR Login Interface loadhistroyorgtree sql injectionEPSS 3.7%CVE-2026-48136MEDIUMAuthenticated Administrator Role-Based Access Control Bypass in ComplianceEPSS 3.7%CVE-2024-12270HIGHBeautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL InjectionEPSS 3.7%CVE-2022-21664HIGHSQL injection in WordPressEPSS 3.7%CVE-2023-43374CRITICALHoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.EPSS 3.7%CVE-2024-11305MEDIUMAltenergy Power Control Software status_zigbee get_status_zigbee sql injectionEPSS 3.7%CVE-2018-15441CRITICALCisco Prime License Manager SQL Injection VulnerabilityEPSS 3.7%CVE-2023-33338CRITICALOld Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.EPSS 3.6%CVE-2024-49574HIGHSQL InjectionEPSS 3.6%CVE-2024-33559CRITICALWordPress XStore theme <= 9.3.5 - Unauthenticated SQL Injection vulnerabilityEPSS 3.6%CVE-2017-3221—Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwoEPSS 3.5%CVE-2017-6050—A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user inpuEPSS 3.5%CVE-2026-25746HIGHOpenEMR has SQL Injection VulnerabilityEPSS 3.5%CVE-2021-27468CRITICALRockwell Automation FactoryTalk AssetCentre SQL InjectionEPSS 3.5%CVE-2022-24281HIGHA vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacEPSS 3.5%CVE-2021-27464CRITICALRockwell Automation FactoryTalk AssetCentre SQL InjectionEPSS 3.5%CVE-2021-38391—A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 andEPSS 3.5%CVE-2022-34876MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.EPSS 3.4%CVE-2023-34754CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=pluginsEPSS 3.4%