Fallos del tipo CWE-89

13.087 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-70024CRITICALAn issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0EPSS 0.5%CVE-2026-26707CRITICALsourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.EPSS 0.5%CVE-2025-7888MEDIUMTDuckCloud tduck-platform UserFormDataMapper.java UserFormDataMapper sql injectionEPSS 0.5%CVE-2023-7081CRITICALSQLi in PosTahsil's Online Payment SystemEPSS 0.5%CVE-2025-4264MEDIUMPHPGurukul Emergency Ambulance Hiring Portal edit-ambulance.php sql injectionEPSS 0.5%CVE-2025-4266MEDIUMPHPGurukul Notice Board System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-4030MEDIUMPHPGurukul COVID19 Testing Management System search-report-result.php sql injectionEPSS 0.5%CVE-2025-4005MEDIUMPHPGurukul COVID19 Testing Management System patient-report.php sql injectionEPSS 0.5%CVE-2024-2069MEDIUMSourceCodester FAQ Management System delete-faq.php sql injectionEPSS 0.5%CVE-2025-4262MEDIUMPHPGurukul Online DJ Booking Management System user-search.php sql injectionEPSS 0.5%CVE-2023-49969MEDIUMCustomer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=EPSS 0.5%CVE-2024-41370CRITICALOrganizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.EPSS 0.5%CVE-2024-50942CRITICALqiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.EPSS 0.5%CVE-2024-36082MEDIUMSQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an admEPSS 0.5%CVE-2025-4014MEDIUMPHPGurukul Art Gallery Management System manage-art-medium.php sql injectionEPSS 0.5%CVE-2025-4031MEDIUMPHPGurukul Pre-School Enrollment System aboutus.php sql injectionEPSS 0.5%CVE-2024-7871HIGHHuachu Easytest Online Learning Test Platform - SQL InjectionEPSS 0.5%CVE-2025-39481CRITICALWordPress Eventer plugin < 3.11.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-15673MEDIUMSMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' SettingsEPSS 0.5%CVE-2025-4004MEDIUMPHPGurukul COVID19 Testing Management System password-recovery.php sql injectionEPSS 0.5%