Fallos del tipo CWE-89

13.163 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-29894HIGHQsync CentralEPSS 0.5%CVE-2025-29893HIGHQsync CentralEPSS 0.5%CVE-2026-38626CRITICALGarlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.EPSS 0.5%CVE-2026-75336CRITICALFuniture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.EPSS 0.5%CVE-2026-7486CRITICALSQLi in Netcad's E-İmarEPSS 0.5%CVE-2024-47325HIGHWordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-35614CRITICALFrappe has a SQL injection in bulk_updateEPSS 0.5%CVE-2024-11912HIGHTraveler <= 3.1.6 - Unauthenticated SQL Injection via order_idEPSS 0.5%CVE-2026-4978CRITICALSQLi in UMAI Vision's Traffic Analysis SystemEPSS 0.5%CVE-2026-37431CRITICALBeauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointmenEPSS 0.5%CVE-2026-50890CRITICALBernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings.EPSS 0.5%CVE-2026-34220CRITICALMikroORM is vulnerable to SQL Injection via specially crafted objectEPSS 0.5%CVE-2026-22596MEDIUMGhost has SQL Injection in Members Activity FeedEPSS 0.5%CVE-2026-51775CRITICALSQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controllerEPSS 0.5%CVE-2026-1617CRITICALSQLi in Turkmesh's Turkhotspot 5651 LoglamaEPSS 0.5%CVE-2026-88402CRITICALA SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injeEPSS 0.5%CVE-2026-7188CRITICALSQLi in Armiya Information Technologies' Access Control SystemEPSS 0.5%CVE-2026-79570CRITICALmfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnEPSS 0.5%CVE-2026-37340CRITICALSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit_music.php.EPSS 0.5%CVE-2026-37339CRITICALSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.EPSS 0.5%