Fallos del tipo CWE-89

13.119 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-8253MEDIUMcode-projects Exam Form Submission delete_s6.php sql injectionEPSS 0.5%CVE-2025-8250MEDIUMcode-projects Exam Form Submission update_s4.php sql injectionEPSS 0.5%CVE-2025-6937MEDIUMcode-projects Simple Pizza Ordering System large.php sql injectionEPSS 0.5%CVE-2026-30951HIGHSequelize v6 Vulnerable to SQL Injection via JSON Column Cast TypeEPSS 0.5%CVE-2024-13078MEDIUMPHPGurukul Land Record System index.php sql injectionEPSS 0.5%CVE-2025-6503MEDIUMcode-projects Inventory Management System fetchSelectedCategories.php sql injectionEPSS 0.5%CVE-2025-2951MEDIUMBluestar Micro Mall data.php sql injectionEPSS 0.5%CVE-2024-8924HIGHUnauthenticated Blind SQL Injection in Core PlatformEPSS 0.5%CVE-2026-62238HIGHOpenRemote < 1.26.0 SQL Injection via Crosstab ExportEPSS 0.5%CVE-2024-20417MEDIUMCisco Identity Services Engine REST API Blind SQL Injection VulnerabitiesEPSS 0.5%CVE-2024-0543MEDIUMCodeAstro Real Estate Management System propertydetail.php sql injectionEPSS 0.5%CVE-2019-25458HIGHWeb Ofisi Firma Rehberi v1 SQL Injection via firmalar.htmlEPSS 0.5%CVE-2025-8249MEDIUMcode-projects Exam Form Submission update_s3.php sql injectionEPSS 0.5%CVE-2025-6346MEDIUMSourceCodester Advance Charity Management System fundDetails.php sql injectionEPSS 0.5%CVE-2025-6935MEDIUMCampcodes Sales and Inventory System payment_add.php sql injectionEPSS 0.5%CVE-2025-6936MEDIUMcode-projects Simple Pizza Ordering System addpro.php sql injectionEPSS 0.5%CVE-2026-34825HIGHNocoBase Has SQL Injection via template variable substitution in workflow SQL nodeEPSS 0.5%CVE-2026-61461HIGHDify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_textEPSS 0.5%CVE-2025-44073CRITICALSeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.EPSS 0.5%CVE-2024-40072CRITICALSourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/aEPSS 0.5%