Fallos del tipo CWE-89

13.086 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-11213MEDIUMSourceCodester Best Employee Management System edit_role.php sql injectionEPSS 0.5%CVE-2025-5119MEDIUMEmlog Pro api_controller.php sql injectionEPSS 0.5%CVE-2024-55977CRITICALWordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-54350CRITICALBudibase: Anonymous NoSQL operator injection via published-app query templatesEPSS 0.5%CVE-2024-11430MEDIUMSQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2021-43766—Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client autheEPSS 0.5%CVE-2024-50766CRITICALSourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter.EPSS 0.5%CVE-2025-65950CRITICALWBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] ParameterEPSS 0.5%CVE-2019-25510HIGHJettweb PHP Hazir Haber Sitesi Scripti V2 Authentication BypassEPSS 0.5%CVE-2024-54361CRITICALWordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-35349CRITICALA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.5%CVE-2024-40689MEDIUMIBM InfoSphere Information Server SQL injectionEPSS 0.5%CVE-2024-54234CRITICALWordPress Limit Login Attempts plugin <= 5.5 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-12938MEDIUMcode-projects Simple Admin Panel updateOrderStatus.php sql injectionEPSS 0.5%CVE-2025-3143MEDIUMSourceCodester Apartment Visitor Management System visitor-entry.php sql injectionEPSS 0.5%CVE-2025-2063MEDIUMprojectworlds Life Insurance Management System deleteNominee.php sql injectionEPSS 0.5%CVE-2024-53506CRITICALA SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.EPSS 0.5%CVE-2024-0462MEDIUMcode-projects Online Faculty Clearance HTTP POST Request designee_view_status.php sql injectionEPSS 0.5%CVE-2025-2067MEDIUMprojectworlds Life Insurance Management System search.php sql injectionEPSS 0.5%CVE-2024-1821MEDIUMcode-projects Crime Reporting System police_add.php sql injectionEPSS 0.5%