Fallos del tipo CWE-89

13.617 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-25833CRITICALF-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitEPSS 2.8%CVE-2025-34112CRITICALRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCEEPSS 2.8%CVE-2021-21024CRITICALMagento Commerce Blind SQL Injection Could Lead To Unauthorized AccessEPSS 2.8%CVE-2022-45297CRITICALEQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.EPSS 2.8%CVE-2018-1132HIGHA flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticatingEPSS 2.8%CVE-2026-18912HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticateEPSS 2.8%CVE-2020-29493CRITICALDELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacEPSS 2.7%CVE-2025-4396HIGHRelevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL InjectionEPSS 2.7%CVE-2021-36520HIGHA SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.EPSS 2.7%CVE-2024-12025HIGHCollapsing Categories <= 3.0.8 - Unauthenticated SQL InjectionEPSS 2.7%CVE-2022-45030HIGHA SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with securEPSS 2.7%CVE-2023-30192CRITICALPrestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().EPSS 2.7%CVE-2025-6095MEDIUMcodesiddhant Jasmin Ransomware checklogin.php sql injectionEPSS 2.7%CVE-2022-27596CRITICALVulnerability in QTSEPSS 2.7%CVE-2026-70049HIGHMicrosoft Configuration Manager Elevation of Privilege VulnerabilityEPSS 2.7%CVE-2024-0705CRITICALStripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL InjectionEPSS 2.6%CVE-2020-6137CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passworEPSS 2.6%CVE-2020-6138CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page EPSS 2.6%CVE-2020-6139CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the passworEPSS 2.6%CVE-2020-6140CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passworEPSS 2.6%