Fallos del tipo CWE-89

12.839 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2020-6114MEDIUMAn exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09EPSS 1.7%CVE-2024-36428HIGHOrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.EPSS 1.7%CVE-2024-32128CRITICALWordPress Realtyna Organic IDX plugin + WPL Real Estate plugin <= 4.14.4 - Unauthenticated SQL Injection vulnerabilityEPSS 1.7%CVE-2024-32655HIGHNpgsql Vulnerable to SQL Injection via Protocol Message Size OverflowEPSS 1.7%CVE-2024-34780HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 1.7%CVE-2024-32844HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 1.7%CVE-2024-34784HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 1.7%CVE-2024-34782HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 1.7%CVE-2017-3181—Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL queryEPSS 1.7%CVE-2021-24728—Paid Member Subscriptions < 2.4.2 - Authenticated SQL InjectionEPSS 1.7%CVE-2021-24727—Block and Stop Bad Bots < 6.60 - Authenticated SQL InjectionsEPSS 1.7%CVE-2020-22452CRITICALSQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_enginEPSS 1.7%CVE-2019-11821HIGHSQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackEPSS 1.7%CVE-2026-46364CRITICALphpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptchaEPSS 1.7%CVE-2025-47172HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2025-2221HIGHWPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL InjectionEPSS 1.7%CVE-2023-30839CRITICALPrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"EPSS 1.7%CVE-2025-41403HIGHSQL InjectionEPSS 1.7%CVE-2021-24949—The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL InjectionEPSS 1.7%CVE-2020-13525MEDIUMThe sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMEPSS 1.7%