Fallos del tipo CWE-89

13.087 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-15498CRITICALSQL Injection in Pro3W CMSEPSS 0.5%CVE-2023-3661MEDIUMSourceCodester AC Repair and Services System sql injectionEPSS 0.5%CVE-2024-9093MEDIUMSourceCodester Profile Registration without Reload Refresh GET Parameter del.php sql injectionEPSS 0.5%CVE-2024-22719HIGHSQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a clientEPSS 0.5%CVE-2024-4913MEDIUMCampcodes Online Examination System exam.php sql injectionEPSS 0.5%CVE-2023-1591MEDIUMSourceCodester Automatic Question Paper Generator System sql injectionEPSS 0.5%CVE-2023-50848HIGHWordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-31260HIGHWordPress Edwiser Bridge plugin <= 3.0.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-3658MEDIUMSourceCodester AC Repair and Services System HTTP POST Request sql injectionEPSS 0.5%CVE-2023-50854HIGHWordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-3657MEDIUMSourceCodester AC Repair and Services System HTTP POST Request sql injectionEPSS 0.5%CVE-2023-50845HIGHWordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-1466MEDIUMSourceCodester Student Study Center Desk Management System view_student sql injectionEPSS 0.5%CVE-2023-0982MEDIUMSourceCodester Yoga Class Registration System Add Class Entry sql injectionEPSS 0.5%CVE-2024-5981MEDIUMitsourcecode Online House Rental System manage_user.php sql injectionEPSS 0.5%CVE-2025-26200HIGHSQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php componeEPSS 0.5%CVE-2023-50856HIGHWordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2026-6929HIGHJoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' ParameterEPSS 0.5%CVE-2023-0986MEDIUMSourceCodester Sales Tracker Management System Edit User sql injectionEPSS 0.5%CVE-2018-25204HIGHLibrary CMS 1.0 SQL Injection via admin loginEPSS 0.5%