Fallos del tipo CWE-89

12.839 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2013-10033CRITICALKimai 0.9.2 db_restore.php SQL InjectionEPSS 1.8%CVE-2025-9744MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 1.8%CVE-2020-6135MEDIUMAn exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request EPSS 1.8%CVE-2020-6136MEDIUMAn exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP reqEPSS 1.8%CVE-2020-6145MEDIUMAn SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request cEPSS 1.8%CVE-2020-6125MEDIUMAn exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request EPSS 1.8%CVE-2025-22953CRITICALA SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57EPSS 1.8%CVE-2025-51683CRITICALA blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crEPSS 1.8%CVE-2021-38324HIGHSP Rental Manager <= 1.5.3 Unauthenticated SQL InjectionEPSS 1.8%CVE-2026-76904CRITICALGeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layersEPSS 1.8%CVE-2025-10090MEDIUMJinher OA GetTreeDate.aspx sql injectionEPSS 1.8%CVE-2024-31460MEDIUMCacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in databaseEPSS 1.8%CVE-2019-5476—An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able tEPSS 1.8%CVE-2023-0938MEDIUMSourceCodester Music Gallery Site GET Request music_list.php sql injectionEPSS 1.8%CVE-2024-54761MEDIUMBigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.EPSS 1.8%CVE-2025-7160MEDIUMPHPGurukul Zoo Management System index.php sql injectionEPSS 1.8%CVE-2024-50328HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 1.8%CVE-2024-39842HIGHA SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massiveEPSS 1.8%CVE-2021-26609HIGHWordPress Mangboard SQL-Injection vulnerabilityEPSS 1.8%CVE-2020-6128MEDIUMSQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL EPSS 1.8%