Fallos del tipo CWE-89

12.839 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2021-41971—Possible SQL Injection when template processing is enabledEPSS 1.8%CVE-2020-36195CRITICALSQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-OnEPSS 1.8%CVE-2026-40887CRITICAL@vendure/core has a SQL Injection vulnerabilityEPSS 1.8%CVE-2022-0836—SEMA API < 4.02 - Unauthenticated SQLiEPSS 1.8%CVE-2025-2010HIGHJobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL InjectionEPSS 1.8%CVE-2020-5725—The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthEPSS 1.8%CVE-2024-55982CRITICALWordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerabilityEPSS 1.8%CVE-2022-0782—Donations <= 1.8 - Unauthenticated SQLiEPSS 1.7%CVE-2022-0657—5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLiEPSS 1.7%CVE-2025-8324CRITICALSQL InjectionEPSS 1.7%CVE-2021-24183—Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_formEPSS 1.7%CVE-2021-24182—Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_questionEPSS 1.7%CVE-2023-0962MEDIUMSourceCodester Music Gallery Site GET Request Master.php sql injectionEPSS 1.7%CVE-2025-62389MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 1.7%CVE-2025-62390MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 1.7%CVE-2024-13322HIGHAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL InjectionEPSS 1.7%CVE-2025-62387MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 1.7%CVE-2018-15447MEDIUMCisco Integrated Management Controller Supervisor SQL Injection VulnerabilityEPSS 1.7%CVE-2023-0915MEDIUMSourceCodester Auto Dealer Management System sql injectionEPSS 1.7%CVE-2020-6114MEDIUMAn exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09EPSS 1.7%