Fallos del tipo CWE-89

12.842 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2020-13525MEDIUMThe sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMEPSS 1.7%CVE-2023-39526CRITICALPrestaShopSQL manager vulnerability (potential RCE)EPSS 1.7%CVE-2023-0904MEDIUMSourceCodester Employee Task Management System task-details.php sql injectionEPSS 1.7%CVE-2023-3047CRITICALSQLi in TMT's LockcellEPSS 1.7%CVE-2023-39417HIGHPostgresql: extension script @substitutions@ within quoting allow sql injectionEPSS 1.7%CVE-2023-5153MEDIUMD-Link DAR-8000 querysql.php sql injectionEPSS 1.7%CVE-2021-29090HIGHImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo StatioEPSS 1.7%CVE-2022-38118HIGHHGiga OAKlouds - SQL InjectionEPSS 1.7%CVE-2025-8311CRITICALdotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uEPSS 1.7%CVE-2026-34885HIGHWordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerabilityEPSS 1.7%CVE-2022-0258HIGHSQL Injection in pimcore/pimcoreEPSS 1.7%CVE-2023-29622CRITICALPurchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admin/lEPSS 1.7%CVE-2025-3834HIGHSQL InjectionEPSS 1.7%CVE-2017-12731—A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSiEPSS 1.6%CVE-2023-35088CRITICALApache InLong: SQL injection in audit endpointEPSS 1.6%CVE-2021-24651—Poll Maker < 3.4.2 - Unauthenticated Time Based SQL InjectionEPSS 1.6%CVE-2024-2387MEDIUMAdvanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration_idEPSS 1.6%CVE-2021-22847HIGHHyweb HyCMS-J1 - SQL InjectionEPSS 1.6%CVE-2023-2215MEDIUMCampcodes Coffee Shop POS System manage_user.php sql injectionEPSS 1.6%CVE-2023-0913MEDIUMSourceCodester Auto Dealer Management System sql injectionEPSS 1.6%