Fallos del tipo CWE-89

13.617 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2019-12683HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12680HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12679HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12681HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12682HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12684HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2025-1323HIGHWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL InjectionEPSS 2.9%CVE-2020-25638HIGHA flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA CriteriEPSS 2.9%CVE-2020-13499CRITICALAn SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SEPSS 2.9%CVE-2020-13501CRITICALAn SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SEPSS 2.9%CVE-2020-13500CRITICALSQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SpecEPSS 2.9%CVE-2022-34871HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2024-8911CRITICALLatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionEPSS 2.9%CVE-2022-27479—SQL injection vulnerability in chart data APIEPSS 2.9%CVE-2022-42426HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2022-42428HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2021-35234HIGHExposed Dangerous Functions - Privileged EscalationEPSS 2.9%CVE-2021-24385—Filebird 4.7.3 - Unauthenticated SQL InjectionEPSS 2.8%CVE-2022-2272CRITICALThis vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is EPSS 2.8%CVE-2023-6575MEDIUMByzoro S210 HTTP POST Request repair.php sql injectionEPSS 2.8%