Fallos del tipo CWE-89

13.546 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2021-24931—Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL InjectionEPSS 78.8%CVE-2024-32640CRITICALMasaCMS SQL Injection vulnerabilityEPSS 78.4%CVE-2024-1512CRITICALMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL InjectionEPSS 77.7%CVE-2025-26794HIGHExim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires aEPSS 77.6%CVE-2022-25149CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IPEPSS 77.5%CVE-2024-1698CRITICALNotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL InjectionEPSS 77.4%CVE-2024-8877MEDIUMSQL InjectionEPSS 77.3%CVE-2022-42427HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 76.1%CVE-2022-42424HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 76.1%CVE-2022-42429HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 76.1%CVE-2022-42425HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 76.1%CVE-2021-42258CRITICALBQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in thEPSS 75.2%KEVCVE-2022-43671CRITICALZoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.EPSS 74.8%CVE-2022-0169—Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL InjectionEPSS 74.6%CVE-2023-49085HIGHCacti SQL Injection vulnerabilityEPSS 74.5%CVE-2022-36961HIGHOrion Platform SQL Injection Privilege Escalation VulnerabilityEPSS 74.3%CVE-2022-0412—TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL InjectionEPSS 74.0%CVE-2021-24946—Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL InjectionEPSS 72.8%CVE-2023-34133HIGHImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an EPSS 72.8%CVE-2021-24862—RegistrationMagic < 5.0.1.6 - Admin+ SQL InjectionEPSS 72.7%