Fallos del tipo CWE-89

13.095 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-4961MEDIUMWeitong Mall OrderDao.xml sql injectionEPSS 0.5%CVE-2024-25288MEDIUMSLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.EPSS 0.5%CVE-2026-27681CRITICALSQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business WarehouseEPSS 0.5%CVE-2023-33945MEDIUMSQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updatEPSS 0.5%CVE-2024-30242HIGHWordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerabilityEPSS 0.5%CVE-2024-30240HIGHWordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-30570HIGHWordPress دکمه، شبکه اجتماعی خرید plugin <= 2.0.6 - SQL Injection VulnerabilityEPSS 0.5%CVE-2025-10596MEDIUMSourceCodester Online Exam Form Submission index.php sql injectionEPSS 0.5%CVE-2026-21410CRITICALInSAT MasterSCADA BUK-TS SQL InjectionEPSS 0.5%CVE-2025-9418MEDIUMitsourcecode Apartment Management System addowner.php sql injectionEPSS 0.5%CVE-2025-9002MEDIUMSurbowl dormitory-management-php login.php sql injectionEPSS 0.5%CVE-2024-29732CRITICALSQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from AbastEPSS 0.5%CVE-2025-9420MEDIUMitsourcecode Apartment Management System addfloor.php sql injectionEPSS 0.5%CVE-2026-87238HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.5%CVE-2026-87202HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.5%CVE-2025-30571HIGHWordPress STEdb Forms plugin <= 1.0.4 - SQL Injection VulnerabilityEPSS 0.5%CVE-2024-6736MEDIUMSourceCodester Employee and Visitor Gate Pass Logging System view_employee.php sql injectionEPSS 0.5%CVE-2025-3676MEDIUMxxyopen Novel-Plus books sql injectionEPSS 0.5%CVE-2025-10784MEDIUMCampcodes Online Learning Management System edit_subject.php sql injectionEPSS 0.5%CVE-2025-30523HIGHWordPress Super Simple Subscriptions plugin <= 1.1.0 - SQL Injection vulnerabilityEPSS 0.5%