Fallos del tipo CWE-89

13.095 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-5977MEDIUMcode-projects School Fees Payment System datatable.php sql injectionEPSS 0.5%CVE-2025-6155MEDIUMPHPGurukul Hostel Management System login-hm.inc.php sql injectionEPSS 0.5%CVE-2025-25515HIGHSeacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.EPSS 0.5%CVE-2025-69562CRITICALcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter.EPSS 0.5%CVE-2025-69563CRITICALcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter.EPSS 0.5%CVE-2025-62422HIGHDataEase SQL injection vulnerabilityEPSS 0.5%CVE-2024-7349HIGHLifterLMS <= 7.7.5 - Authenticated (Admin+) SQL InjectionEPSS 0.5%CVE-2025-32550HIGHWordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-5172MEDIUMEcontrata valida sql injectionEPSS 0.5%CVE-2025-10011MEDIUMPortabilis i-Educar edit sql injectionEPSS 0.5%CVE-2024-37896HIGHSQL injection vulnerability in Gin-vue-adminEPSS 0.5%CVE-2026-61818HIGHpg_partman SQL injection in undo partition time encoderEPSS 0.5%CVE-2026-71808HIGHA SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands vEPSS 0.5%CVE-2025-2039MEDIUMcode-projects Blood Bank Management System delete_members.php sql injectionEPSS 0.5%CVE-2025-2044MEDIUMcode-projects Blood Bank Management System delete_bloodGroup.php sql injectionEPSS 0.5%CVE-2026-44047HIGHSQL injection in MySQL CNID backendEPSS 0.5%CVE-2024-58307CRITICALCSZCMS 1.3.0 Authenticated SQL Injection via Members View EndpointEPSS 0.5%CVE-2026-39815HIGHA improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7EPSS 0.5%CVE-2023-40921CRITICALSQL Injection vulnerability in functions/point_list.php in Common Services soliberte before v4.3.03 allows attackers to obtain sensitive infEPSS 0.5%CVE-2026-97882MEDIUMmathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injectionEPSS 0.5%