Fallos del tipo CWE-89

13.085 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-32603CRITICALWordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-2684MEDIUMPHPGurukul Bank Locker Management System search-report-details.php sql injectionEPSS 0.5%CVE-2024-31495LOWA improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 EPSS 0.5%CVE-2025-1981CRITICALSQL Injection in Ready_EPSS 0.5%CVE-2024-0272MEDIUMKashipara Food Management System addmaterialsubmit.php sql injectionEPSS 0.5%CVE-2025-1572MEDIUMKiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' ParameterEPSS 0.5%CVE-2024-12745HIGHSQL Injection in the Amazon Redshift Python Connector affecting v2.1.4EPSS 0.5%CVE-2025-4244MEDIUMcode-projects Online Bus Reservation System seatlocation.php sql injectionEPSS 0.5%CVE-2025-3796MEDIUMPHPGurukul Men Salon Management System contact-us.php sql injectionEPSS 0.5%CVE-2023-2412MEDIUMSourceCodester AC Repair and Services System manage_user.php sql injectionEPSS 0.5%CVE-2025-4060MEDIUMPHPGurukul Notice Board System category.php sql injectionEPSS 0.5%CVE-2025-6169CRITICALHAMASTAR Technology WIMP website co-construction management platform - SQL InjectionEPSS 0.5%CVE-2024-2060MEDIUMSourceCodester Petrol Pump Management Software login_crud.php sql injectionEPSS 0.5%CVE-2025-65133CRITICALA SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remEPSS 0.5%CVE-2025-4243MEDIUMcode-projects Online Bus Reservation System print.php sql injectionEPSS 0.5%CVE-2026-51077HIGHSQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of theEPSS 0.5%CVE-2025-4247MEDIUMSourceCodester Simple To-Do List System delete_task.php sql injectionEPSS 0.5%CVE-2025-3817MEDIUMSourceCodester Online Eyewear Shop Master.php sql injectionEPSS 0.5%CVE-2026-19351MEDIUMdresende node-sql-query Request Parameter Select.js SelectQuery.build sql injectionEPSS 0.5%CVE-2024-0281MEDIUMKashipara Food Management System loginCheck.php sql injectionEPSS 0.5%