Fallos del tipo CWE-89

13.113 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-23911HIGHWordPress Solidres – Hotel booking plugin for WordPress Plugin <= 0.9.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-2579HIGHWowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' ParameterEPSS 0.5%CVE-2024-8607HIGHSQLi in Oceanic Software's ValeAppEPSS 0.5%CVE-2025-44034HIGHSQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/EPSS 0.5%CVE-2026-4306HIGHWP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' ParameterEPSS 0.5%CVE-2026-14785HIGHWeb Directory Free <= 1.7.13 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2025-15207MEDIUMCampcodes Supplier Management System view_products.php sql injectionEPSS 0.5%CVE-2026-9179HIGHWP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' ParameterEPSS 0.5%CVE-2026-15290HIGHUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL InjectionEPSS 0.5%CVE-2025-8493MEDIUMcode-projects Intern Membership Management System edit_student_query.php sql injectionEPSS 0.5%CVE-2025-34059HIGHDahua Smart Cloud Gateway Registration Management Platform SQL InjectionEPSS 0.5%CVE-2025-23912HIGHWordPress WordPress Custom Sidebar Plugin <= 2.3 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-8912HIGHContest Gallery <= 28.1.6 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2025-63564CRITICALSQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP reEPSS 0.5%CVE-2026-12741HIGHWP Fast Total Search <= 1.80.280 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2026-12753HIGHAdvance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' ParameterEPSS 0.5%CVE-2020-37154HIGHeLection 2.0 - 'id' SQL InjectionEPSS 0.5%CVE-2025-6827MEDIUMcode-projects Inventory Management System editOrder.php sql injectionEPSS 0.5%CVE-2025-9592MEDIUMitsourcecode Apartment Management System bill_info.php sql injectionEPSS 0.5%CVE-2025-12325MEDIUMSourceCodester Best Salon Management System forgot-password.php sql injectionEPSS 0.5%