Fallos del tipo CWE-89

13.166 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-44830CRITICALEngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface.EPSS 0.5%CVE-2026-29081MEDIUMFrappe: Possibility of SQL Injection due to improper fieldname sanitizationEPSS 0.5%CVE-2024-11710MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL InjectionEPSS 0.5%CVE-2025-3229MEDIUMPHPGurukul Restaurant Table Booking System edit-subadmin.php sql injectionEPSS 0.5%CVE-2026-34185HIGHSQL Injection in AlanWeb SCADAEPSS 0.5%CVE-2025-26946HIGHWordPress WP Yelp Review Slider Plugin <= 8.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-52436HIGHWordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-1210MEDIUMcode-projects Wazifa System control.php sql injectionEPSS 0.5%CVE-2026-13744HIGHSnowflake CLI SQL Injection Through Improper Neutralization of User-Controlled InputEPSS 0.5%CVE-2024-52435HIGHWordPress Premium Packages – Sell Digital Products Securely plugin <= 6.0.5 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-44756CRITICALNUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogEPSS 0.5%CVE-2025-24672HIGHWordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-8344MEDIUMCampcodes Supplier Management System edit_area.php sql injectionEPSS 0.5%CVE-2025-25116HIGHWordPress Link to URL / Post plugin <=1.3 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-65980HIGHChartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable SubstitutionEPSS 0.5%CVE-2026-33714HIGHChamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)EPSS 0.5%CVE-2025-1189MEDIUM1000 Projects Attendance Tracking Management System chart1.php sql injectionEPSS 0.5%CVE-2023-38724MEDIUMIBM Cognos Controller SQL injectionEPSS 0.5%CVE-2025-3206MEDIUMcode-projects Hospital Management System doctor-specilization.php sql injectionEPSS 0.5%CVE-2024-51672HIGHWordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerabilityEPSS 0.5%