Fallos del tipo CWE-89

13.130 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-7935MEDIUMitsourcecode Project Expense Monitoring System print.php sql injectionEPSS 0.5%CVE-2025-0345MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%CVE-2025-0541MEDIUMCodezips Gym Management System edit_member.php sql injectionEPSS 0.5%CVE-2025-5613MEDIUMPHPGurukul Online Fire Reporting System request-details.php sql injectionEPSS 0.5%CVE-2025-5612MEDIUMPHPGurukul Online Fire Reporting System reporting.php sql injectionEPSS 0.5%CVE-2025-5618MEDIUMPHPGurukul Online Fire Reporting System edit-team.php sql injectionEPSS 0.5%CVE-2026-18782CRITICALSQL Injection in Trex Digital Manufacturing's Trex MESEPSS 0.5%CVE-2026-31858HIGHCraftCMS's `ElementSearchController` Affected by Blind SQL InjectionEPSS 0.5%CVE-2025-1708HIGHCVE-2025-1708EPSS 0.5%CVE-2025-26520HIGHCacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue EPSS 0.5%CVE-2025-5617MEDIUMPHPGurukul Online Fire Reporting System manage-teams.php sql injectionEPSS 0.5%CVE-2026-52775HIGHYesWiki Authenticated SQL Injection in ReactionManagerEPSS 0.5%CVE-2026-15351MEDIUMWC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' ParameterEPSS 0.5%CVE-2026-2283MEDIUMUser Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' ParameterEPSS 0.5%CVE-2025-3402MEDIUMSeeyon Zhiyuan Interconnect FE Collaborative Office Platform check.js%70 sql injectionEPSS 0.5%CVE-2026-17351CRITICALpgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)EPSS 0.5%CVE-2026-54524HIGHFrappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode ReportEPSS 0.5%CVE-2025-30971CRITICALWordPress XV Random Quotes plugin <= 2.0.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-31069HIGHBillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric EPSS 0.5%CVE-2023-52180HIGHWordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 is vulnerable to SQL InjectionEPSS 0.5%