Fallos del tipo CWE-89

13.087 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-4441MEDIUMSourceCodester Free Hospital Management System for Small Practices appointment.php sql injectionEPSS 0.5%CVE-2018-25204HIGHLibrary CMS 1.0 SQL Injection via admin loginEPSS 0.5%CVE-2023-3661MEDIUMSourceCodester AC Repair and Services System sql injectionEPSS 0.5%CVE-2024-31116HIGHWordPress 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-1592MEDIUMSourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injectionEPSS 0.5%CVE-2023-50854HIGHWordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL InjectionEPSS 0.5%CVE-2026-6929HIGHJoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' ParameterEPSS 0.5%CVE-2023-52134HIGHWordPress GEO my WordPress Plugin <= 4.0.2 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-0981MEDIUMSourceCodester Yoga Class Registration System Delete User sql injectionEPSS 0.5%CVE-2024-4912MEDIUMCampcodes Online Examination System addExamExe.php sql injectionEPSS 0.5%CVE-2025-9699MEDIUMSourceCodester Online Polling System Code checklogin.php sql injectionEPSS 0.5%CVE-2026-4662HIGHJetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' ParameterEPSS 0.5%CVE-2023-52132HIGHWordPress WP Adminify Plugin <= 3.1.6 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-10446MEDIUMProject Worlds Online Time Table Generator admindashboard.php sql injectionEPSS 0.5%CVE-2025-8442MEDIUMcode-projects Online Medicine Guide cussignup.php sql injectionEPSS 0.5%CVE-2023-0980MEDIUMSourceCodester Yoga Class Registration System Status Update update_status.php sql injectionEPSS 0.5%CVE-2024-32602HIGHWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-5981MEDIUMitsourcecode Online House Rental System manage_user.php sql injectionEPSS 0.5%CVE-2023-50853HIGHWordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-43699CRITICALDelta Electronics DIAEnergie SQL InjectionEPSS 0.5%