Fallos del tipo CWE-89

13.180 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-3720MEDIUMTianwell Fire Intelligent Command Platform API Interface page sql injectionEPSS 0.5%CVE-2026-61518HIGHISPConfig Authenticated SQL Injection via Remote API primary_id ParameterEPSS 0.5%CVE-2026-34104HIGHGuardian Language-System SQL Injection via name Parameter in designer.phpEPSS 0.5%CVE-2026-8443HIGHWP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' ParameterEPSS 0.5%CVE-2025-24669HIGHWordPress SERPed.net Plugin <= 4.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-3335MEDIUMcodeprojects Online Restaurant Management System category_update.php sql injectionEPSS 0.5%CVE-2024-51060CRITICALProjectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter.EPSS 0.5%CVE-2025-2373MEDIUMPHPGurukul Human Metapneumovirus Testing Management System check_availability.php sql injectionEPSS 0.5%CVE-2025-3299MEDIUMPHPGurukul Men Salon Management System appointment.php sql injectionEPSS 0.5%CVE-2025-3336MEDIUMcodeprojects Online Restaurant Management System member_save.php sql injectionEPSS 0.5%CVE-2025-2471MEDIUMPHPGurukul Boat Booking System boat-details.php sql injectionEPSS 0.5%CVE-2024-2386HIGHWordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2025-2374MEDIUMPHPGurukul Human Metapneumovirus Testing Management System profile.php sql injectionEPSS 0.5%CVE-2025-2052MEDIUMPHPGurukul Apartment Visitors Management System forgot-password.php sql injectionEPSS 0.5%CVE-2025-2051MEDIUMPHPGurukul Apartment Visitors Management System search-visitor.php sql injectionEPSS 0.5%CVE-2020-15878HIGHAn issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LiEPSS 0.5%CVE-2025-3337MEDIUMcodeprojects Online Restaurant Management System member_update.php sql injectionEPSS 0.5%CVE-2026-25241CRITICALPEAR is Vulnerable to SQL Injection in /get/<package>/<version> EndpointEPSS 0.5%CVE-2025-11664MEDIUMCampcodes Online Beauty Parlor Management System search-appointment.php sql injectionEPSS 0.5%CVE-2025-62228MEDIUMApache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiersEPSS 0.5%