Fallos del tipo CWE-89

13.150 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-52474HIGHWeGIA SQL Injection Vulnerability in id Parameter on control.php EndpointEPSS 0.5%CVE-2025-25222HIGHThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrEPSS 0.5%CVE-2024-6041MEDIUMitsourcecode Gym Management System manage_user.php sql injectionEPSS 0.5%CVE-2025-1841MEDIUMESAFENET CDG ClientSortLog.jsp sql injectionEPSS 0.5%CVE-2025-7186MEDIUMcode-projects Chat System fetch_chat.php sql injectionEPSS 0.5%CVE-2026-40822MEDIUMAuthenticated SQLi in DevSerialReset functionEPSS 0.5%CVE-2026-2397CRITICALSQLi in AdamPOS' MobilMen 20TEPSS 0.5%CVE-2026-40826MEDIUMAuthenticated SQLi in dsgvo_contracts viewEPSS 0.5%CVE-2022-39069MEDIUMThere is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attackEPSS 0.5%CVE-2015-20122HIGHSeeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jspEPSS 0.5%CVE-2026-2236HIGHHGiga｜C&Cm@il - SQL InjectionEPSS 0.5%CVE-2026-76428MEDIUMCisco ISE Profiler SQL Injection VulnerabilityEPSS 0.5%CVE-2025-25221HIGHThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.EPSS 0.5%CVE-2026-76426MEDIUMCisco ISE REST API SQL Injection VulnerabilityEPSS 0.5%CVE-2026-40821MEDIUMAuthenticated SQLi in getAccountByID functionEPSS 0.5%CVE-2025-53527HIGHWeGIA allows Time-Based Blind SQL Injection in the relatorio_geracao.php endpointEPSS 0.5%CVE-2025-25876HIGHA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attEPSS 0.5%CVE-2026-48528CRITICALMetacat has an unauthenticated SQL injection vulnerabilityEPSS 0.5%CVE-2025-10563MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.5%CVE-2025-1464MEDIUMBaiyi Cloud Asset Management System admin.house.collect.php sql injectionEPSS 0.5%