Fallos del tipo CWE-89

12.837 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-6095MEDIUMcodesiddhant Jasmin Ransomware checklogin.php sql injectionEPSS 2.7%CVE-2025-4396HIGHRelevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL InjectionEPSS 2.7%CVE-2022-27596CRITICALVulnerability in QTSEPSS 2.7%CVE-2024-0705CRITICALStripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL InjectionEPSS 2.6%CVE-2020-6139CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the passworEPSS 2.6%CVE-2020-6140CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passworEPSS 2.6%CVE-2020-6138CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page EPSS 2.6%CVE-2020-6137CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passworEPSS 2.6%CVE-2019-9885CRITICALeClass platform contains a SQL injection vulnerabilityEPSS 2.6%CVE-2020-29493CRITICALDELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacEPSS 2.6%CVE-2024-5057CRITICALWordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerabilityEPSS 2.6%CVE-2021-24132—Slider by 10Web < 1.2.36 - Multiple Authenticated SQL InjectionEPSS 2.6%CVE-2022-44727CRITICALThe EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).EPSS 2.6%CVE-2024-44541CRITICALevilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."EPSS 2.6%CVE-2024-12025HIGHCollapsing Categories <= 3.0.8 - Unauthenticated SQL InjectionEPSS 2.6%CVE-2023-24000HIGHWordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL InjectionEPSS 2.6%CVE-2024-5678MEDIUMSQL InjectionEPSS 2.5%CVE-2024-5608HIGHSQL InjectionEPSS 2.5%CVE-2014-2351—CSWorks SQL InjectionEPSS 2.5%CVE-2019-10141HIGHA vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulneraEPSS 2.5%