Fallos del tipo CWE-89

12.845 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2021-24403—WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL InjectionEPSS 1.5%CVE-2021-24625—SpiderCatalog <= 1.7.3 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24398—Responsive 3D Slider <= 1.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2020-11004HIGHSQL Injection in AdmidioEPSS 1.5%CVE-2025-5569MEDIUMIdeaCMS getList.html Goods sql injectionEPSS 1.5%CVE-2025-54726CRITICALWordPress JS Archive List Plugin < 6.1.6 - SQL Injection VulnerabilityEPSS 1.5%CVE-2023-39344CRITICALsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEEPSS 1.5%CVE-2026-28501CRITICALWWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.phpEPSS 1.5%CVE-2020-13591MEDIUMAn exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A sEPSS 1.5%CVE-2020-13592MEDIUMAn exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A speciallEPSS 1.5%CVE-2020-13587MEDIUMAn exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A EPSS 1.5%CVE-2021-24149—Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24137—Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL InjectionEPSS 1.5%CVE-2024-42005CRITICALAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONFEPSS 1.5%CVE-2022-31890CRITICALSQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae viaEPSS 1.5%CVE-2021-25045—Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_idEPSS 1.5%CVE-2021-24865—Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionEPSS 1.5%CVE-2026-18912HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticateEPSS 1.5%CVE-2021-24753—Rich Reviews by Starfish < 1.9.6 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24747—SEO Booster < 3.8 - Admin+ SQL InjectionEPSS 1.5%