Fallos del tipo CWE-89

13.195 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-7608MEDIUMcode-projects Simple Shopping Cart userlogin.php sql injectionEPSS 0.5%CVE-2025-7539MEDIUMcode-projects Online Appointment Booking System getdoctordaybooking.php sql injectionEPSS 0.5%CVE-2025-7457MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_movie.php sql injectionEPSS 0.5%CVE-2024-5792HIGHHouzez CRM <= 1.4.2 - Authenticated (Seller+) SQL InjectionEPSS 0.5%CVE-2025-7436MEDIUMCampcodes Online Recruitment Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4021MEDIUMcode-projects Patient Record Management System edit_spatient.php sql injectionEPSS 0.5%CVE-2024-5793HIGHHouzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL InjectionEPSS 0.5%CVE-2024-33963CRITICALSQL injection in Janobe productsEPSS 0.5%CVE-2024-10338MEDIUMSourceCodeHero Clothes Recommendation System home.php sql injectionEPSS 0.5%CVE-2025-7483MEDIUMPHPGurukul Vehicle Parking Management System forgot-password.php sql injectionEPSS 0.5%CVE-2024-37871HIGHSQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackersEPSS 0.5%CVE-2026-39325HIGHChurchCRM has a Blind SQL injection in SettingsUser.phpEPSS 0.5%CVE-2025-59369MEDIUMA SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentiallEPSS 0.5%CVE-2025-23784HIGHWordPress Contact Form 7 Round Robin Lead Distribution Plugin <= 1.2.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-10595MEDIUMSourceCodester Online Student File Management System delete_user.php sql injectionEPSS 0.5%CVE-2025-7753MEDIUMcode-projects Online Appointment Booking System adddoctor.php sql injectionEPSS 0.5%CVE-2024-6417MEDIUMSourceCodester Simple Online Bidding System sql injectionEPSS 0.5%CVE-2024-9081MEDIUMSourceCodester Online Eyewear Shop view_category.php sql injectionEPSS 0.5%CVE-2026-59109HIGHZalktis: SQL injection via partner-controlled fields in imported e-invoicesEPSS 0.5%CVE-2024-12939MEDIUMcode-projects Job Recruitment _all_edits.php add_edu sql injectionEPSS 0.5%