Fallos del tipo CWE-89

13.085 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-50847HIGHWordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-12964MEDIUM1000 Projects Daily College Class Work Report Book login.php sql injectionEPSS 0.5%CVE-2024-10247HIGHYouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL InjectionEPSS 0.5%CVE-2025-0205MEDIUMcode-projects Online Shoe Store details2.php sql injectionEPSS 0.5%CVE-2024-42552HIGHHotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_histoEPSS 0.5%CVE-2019-25675HIGHeDirectory All Versions SQL Injection Authentication BypassEPSS 0.5%CVE-2026-33352CRITICALAVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)EPSS 0.5%CVE-2023-50844HIGHWordPress WP Mail Catcher Plugin <= 2.1.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-49825HIGHWordPress Soledad Theme <= 8.4.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-41618CRITICALMoney Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. The vulnerabEPSS 0.5%CVE-2026-3057MEDIUMa54552239 pearProjectApi Backend Task.php dateTotalForProject sql injectionEPSS 0.5%CVE-2024-42785HIGHA SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to executeEPSS 0.5%CVE-2024-3604CRITICALOSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2021-47708CRITICALCOMMAX Smart Home IoT Control System SQL Injection Authentication BypassEPSS 0.5%CVE-2024-10162MEDIUMPHPGurukul Boat Booking System Edit Subdomain Details Page edit-subadmin.php sql injectionEPSS 0.5%CVE-2025-2674MEDIUMPHPGurukul Bank Locker Management System aboutus.php sql injectionEPSS 0.5%CVE-2025-2659MEDIUMProject Worlds Online Time Table Generator index.php sql injectionEPSS 0.5%CVE-2025-2665MEDIUMPHPGurukul Online Security Guards Hiring System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2026-1594MEDIUMitsourcecode Society Management System add_expenses.php sql injectionEPSS 0.5%CVE-2025-32565CRITICALWordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerabilityEPSS 0.5%