Fallos del tipo CWE-89

13.150 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-48528CRITICALMetacat has an unauthenticated SQL injection vulnerabilityEPSS 0.5%CVE-2026-58521MEDIUMSQLi in Cargo extension via year range filterEPSS 0.5%CVE-2024-55984HIGHWordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-45019CRITICALA SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. This vuEPSS 0.5%CVE-2025-22527HIGHWordPress Mailing Group Listserv Plugin <= 2.0.9 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-22351HIGHWordPress Contact Form 7 Database – CFDB7 plugin <= 1.0.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-25876HIGHA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attEPSS 0.5%CVE-2026-79322HIGHSQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote uEPSS 0.5%CVE-2025-1464MEDIUMBaiyi Cloud Asset Management System admin.house.collect.php sql injectionEPSS 0.5%CVE-2025-10840MEDIUMSourceCodester Pet Grooming Management Software print-payment.php sql injectionEPSS 0.5%CVE-2024-1924MEDIUMCodeAstro Membership Management System get_membership_amount.php sql injectionEPSS 0.5%CVE-2025-10563MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.5%CVE-2024-57162HIGHCampcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php.EPSS 0.5%CVE-2024-50824LOWA SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name parametEPSS 0.5%CVE-2025-63452CRITICALCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.EPSS 0.5%CVE-2025-9770MEDIUMCampcodes Hospital Management System Admin Dashboard Login admin sql injectionEPSS 0.5%CVE-2025-6535MEDIUMxxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injectionEPSS 0.5%CVE-2026-11360MEDIUMAdvanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' ParameterEPSS 0.5%CVE-2025-6276MEDIUMBrilliance Golden Link Secondary System rentTakeInfoPage.htm sql injectionEPSS 0.5%CVE-2026-55405HIGHLangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvectorEPSS 0.5%