Fallos del tipo CWE-89

13.164 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-8025CRITICALSQLi in MOSK Informatics' CBS PlatformEPSS 0.5%CVE-2026-39196CRITICALDatadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::paEPSS 0.5%CVE-2025-8161MEDIUMdeerwms deer-wms-2 export sql injectionEPSS 0.5%CVE-2025-69214HIGHOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)EPSS 0.5%CVE-2026-50030HIGHDataEase: Arbitrary SQL execution in preview path (direct data disclosure)EPSS 0.5%CVE-2025-8162MEDIUMdeerwms deer-wms-2 list sql injectionEPSS 0.5%CVE-2026-62516HIGHVulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions thaEPSS 0.5%CVE-2025-5432MEDIUMAssamLook CMS view_tender.php sql injectionEPSS 0.5%CVE-2025-69991CRITICALphpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.EPSS 0.5%CVE-2026-45320HIGHDataEase Data Dashboard SqlVariable transFilter Unfiltered SQL InjectionEPSS 0.5%CVE-2025-68496HIGHWordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-11713MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()EPSS 0.5%CVE-2025-44830CRITICALEngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface.EPSS 0.5%CVE-2026-33025HIGHAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY ClauseEPSS 0.5%CVE-2026-52770HIGHImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswikiEPSS 0.5%CVE-2024-11710MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL InjectionEPSS 0.5%CVE-2026-15741HIGHPostgreSQL expression deparse allows SQL injection via EXTRACT argumentEPSS 0.5%CVE-2025-3229MEDIUMPHPGurukul Restaurant Table Booking System edit-subadmin.php sql injectionEPSS 0.5%CVE-2026-34185HIGHSQL Injection in AlanWeb SCADAEPSS 0.5%CVE-2026-29099HIGHSuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.EPSS 0.5%