Fallos del tipo CWE-89

13.232 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-51626HIGHWordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-49616HIGHWordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-2172MEDIUMcode-projects Online Application System for Admission Login Endpoint index.php sql injectionEPSS 0.4%CVE-2024-39620HIGHWordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-0605MEDIUMcode-projects Online Music Site login.php sql injectionEPSS 0.4%CVE-2025-4688CRITICALSQLi in BGS Interactive's SINAV.LINK Exam Result ModuleEPSS 0.4%CVE-2025-13277MEDIUMcode-projects Nero Social Networking Site friendsphoto.php sql injectionEPSS 0.4%CVE-2024-43942HIGHWordPress Greenshift Query and Meta Addon plugin < 3.9.2 - Subscriber+ SQL Injection vulnerabilityEPSS 0.4%CVE-2024-10411MEDIUMSourceCodester Online Hotel Reservation System controller.php doCheckout sql injectionEPSS 0.4%CVE-2026-81728HIGHDolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update KeysEPSS 0.4%CVE-2024-35736HIGHWordPress Visualizer plugin <= 3.11.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-43145HIGHWordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-9776MEDIUMCatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV ImportEPSS 0.4%CVE-2024-49609HIGHWordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-22655CRITICALWordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-10406MEDIUMSourceCodester Petrol Pump Management Software edit_fuel.php sql injectionEPSS 0.4%CVE-2024-43943HIGHWordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerabilityEPSS 0.4%CVE-2025-13422MEDIUMfreeprojectscodes Sports Club Management System change_s_pwd.php sql injectionEPSS 0.4%CVE-2024-49618HIGHWordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-0700MEDIUMcode-projects Intern Membership Management System check_admin.php sql injectionEPSS 0.4%