Fallos del tipo CWE-89

13.130 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-6888MEDIUMPHPGurukul Teachers Record Management System changeimage.php sql injectionEPSS 0.5%CVE-2024-4991CRITICALSQL injection vulnerability in SiAdminEPSS 0.5%CVE-2024-37112CRITICALWordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerabilityEPSS 0.5%CVE-2025-9664MEDIUMcode-projects Simple Grading System Admin Panel add_student_grade.php sql injectionEPSS 0.5%CVE-2024-5543HIGHSlideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2024-48230CRITICALfunadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.EPSS 0.5%CVE-2025-10618MEDIUMitsourcecode Online Clinic Management System transact.php sql injectionEPSS 0.5%CVE-2025-9663MEDIUMcode-projects Simple Grading System Admin Panel edit_account.php sql injectionEPSS 0.5%CVE-2024-45600HIGHFields GLPI plugin has an Authenticated SQL InjectionEPSS 0.5%CVE-2025-4761MEDIUMPHPGurukul Complaint Management System admin-profile.php sql injectionEPSS 0.5%CVE-2025-28087CRITICALSourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.EPSS 0.5%CVE-2026-0501CRITICALSQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)EPSS 0.5%CVE-2025-56421HIGHSQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.EPSS 0.5%CVE-2021-4450HIGHPost Grid <= 2.1.12 - Contributor+ SQL InjectionEPSS 0.5%CVE-2025-7587MEDIUMcode-projects Online Appointment Booking System cover.php sql injectionEPSS 0.5%CVE-2024-2871MEDIUMMedia Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.5%CVE-2025-4940MEDIUM1000 Projects Daily College Class Work Report Book admin_info.php sql injectionEPSS 0.5%CVE-2025-15268HIGHInfility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist BypassEPSS 0.5%CVE-2026-31877CRITICALFrappe SQL Injection due to improper field sanitizationEPSS 0.5%CVE-2025-4930MEDIUMCampcodes Online Shopping Portal my-cart.php sql injectionEPSS 0.5%